chivgent 1.0.1 → 1.1.0

package/dist/auth/oauth.js

@@ -0,0 +1,444 @@
+import { createServer } from "node:http";
+import { randomBytes, createHash, createPublicKey, verify as verifySignature } from "node:crypto";
+import { mkdir, readFile, rename, chmod, writeFile, open, unlink } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+export function oauthFilePath(home = process.env.CHIVGENT_HOME) {
+    return path.join(home || path.join(os.homedir(), ".chivgent"), "oauth.json");
+}
+const fileLocks = new Map();
+async function withFileLock(file, action) {
+    const previous = fileLocks.get(file) ?? Promise.resolve();
+    let release;
+    const next = new Promise((resolve) => { release = resolve; });
+    const queued = previous.then(() => next);
+    fileLocks.set(file, queued);
+    await previous;
+    let lockHandle;
+    try {
+        await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+        const lockPath = `${file}.lock`;
+        const deadline = Date.now() + 30_000;
+        while (!lockHandle && Date.now() < deadline) {
+            try {
+                lockHandle = await open(lockPath, "wx", 0o600);
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+                await new Promise((resolve) => setTimeout(resolve, 100));
+            }
+        }
+        if (!lockHandle)
+            throw new Error(`OAuth credentials are busy in another chivgent process (lock: ${lockPath}); retry shortly. If no process is using it, remove the stale lock file.`);
+        return await action();
+    }
+    finally {
+        if (lockHandle) {
+            await lockHandle.close();
+            await unlink(`${file}.lock`).catch(() => undefined);
+        }
+        release();
+        if (fileLocks.get(file) === queued)
+            fileLocks.delete(file);
+    }
+}
+export async function readOAuthCredentials(file = oauthFilePath()) {
+    try {
+        const text = await readFile(file, "utf8");
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            throw new Error(`The OAuth credential file at ${file} is not valid JSON.`);
+        }
+        if (!Array.isArray(parsed))
+            throw new Error("OAuth credential file must be an array.");
+        if (parsed.some((item) => !isCredential(item)))
+            throw new Error(`The OAuth credential file at ${file} contains an invalid record; refusing to ignore credentials silently.`);
+        return parsed;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+export async function writeOAuthCredential(credential, file = oauthFilePath()) {
+    return withFileLock(file, async () => writeOAuthCredentialUnlocked(credential, file));
+}
+async function writeOAuthCredentialUnlocked(credential, file) {
+    const current = await readOAuthCredentials(file);
+    const next = current.filter((item) => item.provider !== credential.provider);
+    next.push(credential);
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    const temp = `${file}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    await writeFile(temp, `${JSON.stringify(next, null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    await chmod(temp, 0o600);
+    await rename(temp, file);
+    await chmod(file, 0o600);
+}
+export async function removeOAuthCredential(provider, file = oauthFilePath()) {
+    return withFileLock(file, async () => removeOAuthCredentialUnlocked(provider, file));
+}
+async function removeOAuthCredentialUnlocked(provider, file) {
+    const current = await readOAuthCredentials(file);
+    const next = current.filter((item) => item.provider !== provider);
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    const temp = `${file}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    await writeFile(temp, `${JSON.stringify(next, null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    await chmod(temp, 0o600);
+    await rename(temp, file);
+    await chmod(file, 0o600);
+}
+export async function refreshSavedOAuthCredential(provider, file = oauthFilePath(), fetcher = fetch, signal) {
+    signal?.throwIfAborted();
+    return withFileLock(file, async () => {
+        signal?.throwIfAborted();
+        const current = (await readOAuthCredentials(file)).find((item) => item.provider === provider);
+        if (!current)
+            return undefined;
+        if (current.expiresAt >= Date.now() + 60_000)
+            return current;
+        const refreshed = await refreshOAuthCredential(current, fetcher, signal);
+        const latest = (await readOAuthCredentials(file)).find((item) => item.provider === provider);
+        if (!latest || latest.refreshToken !== current.refreshToken || latest.clientId !== current.clientId)
+            throw new Error("OAuth session changed during refresh; sign in again.");
+        await writeOAuthCredentialUnlocked(refreshed, file);
+        return refreshed;
+    });
+}
+export async function refreshOAuthCredential(credential, fetcher = fetch, signal) {
+    if (!credential.refreshToken)
+        throw new Error(`No refresh token is available for ${credential.provider}; sign in again.`);
+    const endpoint = credential.provider === "openai"
+        ? "https://auth.openai.com/api/accounts/oauth/token"
+        : await getXaiTokenEndpoint(fetcher, signal);
+    const body = new URLSearchParams({ grant_type: "refresh_token", client_id: credential.clientId,
+        refresh_token: credential.refreshToken, ...(credential.provider === "openai" ? { resource: "https://api.openai.com/v1" } : {}) });
+    const response = await secureFetch(fetcher, signal)(endpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" }, body });
+    const data = await safeJson(response, "OAuth refresh");
+    if (!response.ok || !data.access_token)
+        throw new Error(`OAuth refresh failed (${safeError(data.error)}); sign in again if the session was revoked.`);
+    validateTokenFields(data, credential.provider, false);
+    return { ...credential, accessToken: data.access_token, refreshToken: data.refresh_token ?? credential.refreshToken,
+        idToken: data.id_token ?? credential.idToken, expiresAt: Date.now() + (data.expires_in ?? 3600) * 1000,
+        scopes: data.scope?.split(" ").filter(Boolean) ?? credential.scopes };
+}
+async function getXaiTokenEndpoint(fetcher, signal) {
+    const response = await secureFetch(fetcher, signal)("https://auth.x.ai/.well-known/openid-configuration");
+    if (!response.ok)
+        throw new Error("Could not load xAI OAuth metadata for token refresh.");
+    const metadata = await safeJson(response, "xAI OAuth metadata");
+    if (metadata.issuer !== "https://auth.x.ai" || metadata.token_endpoint !== "https://auth.x.ai/oauth2/token")
+        throw new Error("xAI OAuth token endpoint failed metadata validation.");
+    return metadata.token_endpoint;
+}
+export async function revokeOAuthCredential(credential, fetcher = fetch) {
+    if (!credential.refreshToken)
+        return false;
+    try {
+        const safeFetch = secureFetch(fetcher);
+        const issuer = credential.provider === "openai" ? "https://auth.openai.com" : "https://auth.x.ai";
+        const discovery = await safeFetch(`${issuer}/.well-known/openid-configuration`);
+        if (!discovery.ok)
+            return false;
+        const metadata = await discovery.json();
+        if (!metadata.revocation_endpoint || new URL(metadata.revocation_endpoint).origin !== issuer)
+            return false;
+        const response = await safeFetch(metadata.revocation_endpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ token: credential.refreshToken, token_type_hint: "refresh_token", client_id: credential.clientId }) });
+        return response.status === 200;
+    }
+    catch {
+        return false;
+    }
+}
+const SAFE_OAUTH_ERRORS = new Set(["access_denied", "authorization_pending", "slow_down", "expired_token", "invalid_grant", "invalid_client", "invalid_request", "server_error", "temporarily_unavailable"]);
+function safeError(value) { return value && SAFE_OAUTH_ERRORS.has(value) ? value : "oauth_error"; }
+async function safeJson(response, label) {
+    try {
+        const value = await response.json();
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            throw new Error();
+        return value;
+    }
+    catch {
+        throw new Error(`Could not parse ${label} response.`);
+    }
+}
+function validateTokenFields(token, provider, requireOpenAIRenewal) {
+    if (typeof token.access_token !== "string" || !token.access_token.trim() ||
+        [token.refresh_token, token.id_token, token.scope].some(value => value !== undefined && typeof value !== "string")) {
+        throw new Error("OAuth returned invalid credential fields.");
+    }
+    if (token.token_type !== undefined && (typeof token.token_type !== "string" || token.token_type.toLowerCase() !== "bearer"))
+        throw new Error("OAuth returned an unsupported token type.");
+    if (token.expires_in !== undefined && (!Number.isFinite(token.expires_in) || token.expires_in <= 0))
+        throw new Error("OAuth returned an invalid token lifetime.");
+    if (requireOpenAIRenewal && (token.token_type?.toLowerCase() !== "bearer" || !Number.isFinite(token.expires_in) || (token.expires_in ?? 0) <= 0 || !token.refresh_token || !token.scope?.split(" ").includes("offline_access")))
+        throw new Error("OpenAI did not grant renewable offline access.");
+}
+function isCredential(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    return v.type === "oauth" && (v.provider === "openai" || v.provider === "xai") &&
+        typeof v.clientId === "string" && v.clientId.length > 0 && typeof v.accessToken === "string" && v.accessToken.length > 0 &&
+        typeof v.expiresAt === "number" && Number.isFinite(v.expiresAt) &&
+        Array.isArray(v.scopes) && v.scopes.every(scope => typeof scope === "string") &&
+        [v.refreshToken, v.idToken, v.subject, v.email].every(value => value === undefined || typeof value === "string");
+}
+function b64url(bytes) { return bytes.toString("base64url"); }
+function randomValue() { return b64url(randomBytes(32)); }
+/** Current OpenAI OSS SIWC registration flow; callback remains loopback-only. */
+export async function signInOpenAI(options) {
+    options.signal?.throwIfAborted();
+    const fetcher = secureFetch(options.fetch ?? fetch, options.signal);
+    const hostId = await getOrCreateHostId(options.file);
+    const previous = (await readOAuthCredentials(options.file)).find((item) => item.provider === "openai");
+    const state = randomValue(), nonce = randomValue(), verifier = randomValue();
+    const challenge = b64url(createHash("sha256").update(verifier).digest());
+    const callback = await (options.startCallback?.(state) ?? listenForCallback(state, options.signal));
+    const auth = new URL("https://auth.openai.com/api/accounts/authorize");
+    const authFields = { client_id: previous?.clientId ?? "dynamic_agent_client",
+        ext_agent_host_id: hostId, response_type: "code", redirect_uri: callback.redirectUri,
+        scope: "openid profile email offline_access resource.invoke chatgpt.tokens.use.direct",
+        resource: "https://api.openai.com/v1", state, nonce, code_challenge_method: "S256", code_challenge: challenge };
+    if (previous === undefined)
+        authFields.agent_name_hint = options.appName;
+    else {
+        if (previous.idToken)
+            authFields.id_token_hint = previous.idToken;
+        if (previous.email)
+            authFields.login_hint = previous.email;
+    }
+    for (const [k, v] of Object.entries(authFields))
+        auth.searchParams.set(k, v);
+    try {
+        if (options.openBrowser)
+            await options.openBrowser(auth.toString());
+        else
+            await openBrowser(auth.toString());
+        const result = await callback.result;
+        if (result.state !== state)
+            throw new Error("OAuth state validation failed.");
+        const clientId = result.client_id ?? previous?.clientId;
+        if (result.error)
+            throw new Error(result.error === "access_denied" ? "Sign-in was declined." : `OpenAI authorization failed (${safeError(result.error)}).`);
+        if (previous && result.client_id && result.client_id !== previous.clientId)
+            throw new Error("OpenAI returned a different client ID than the selected registration.");
+        if (!clientId?.startsWith("oaiapp_") || !result.code)
+            throw new Error("OpenAI registration did not return an issued client ID and authorization code.");
+        const response = await fetcher("https://auth.openai.com/api/accounts/oauth/token", { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" }, body: new URLSearchParams({ grant_type: "authorization_code", client_id: clientId, code: result.code, code_verifier: verifier, redirect_uri: callback.redirectUri, resource: "https://api.openai.com/v1" }) });
+        const token = await safeJson(response, "OpenAI token exchange");
+        if (!response.ok || !token.access_token || !token.id_token)
+            throw new Error(`OpenAI token exchange failed (${safeError(token.error)}).`);
+        validateTokenFields(token, "openai", true);
+        if (!token.scope?.split(" ").includes("resource.invoke") || !token.scope.split(" ").includes("chatgpt.tokens.use.direct"))
+            throw new Error("Required ChatGPT plan usage permissions were not granted.");
+        const identity = await verifyOpenAIIdToken(token.id_token, clientId, nonce, fetcher);
+        if (previous?.subject && previous.subject !== identity.sub)
+            throw new Error("OpenAI sign-in returned a different account than the selected registration.");
+        const credential = { type: "oauth", provider: "openai", clientId, accessToken: token.access_token,
+            ...(token.refresh_token ? { refreshToken: token.refresh_token } : {}), idToken: token.id_token,
+            expiresAt: Date.now() + (token.expires_in ?? 3600) * 1000, scopes: token.scope.split(" "), subject: identity.sub,
+            ...(typeof identity.email === "string" ? { email: identity.email } : {}) };
+        await writeOAuthCredential(credential, options.file);
+        return credential;
+    }
+    finally {
+        callback.close();
+    }
+}
+async function openBrowser(url) {
+    const { spawn } = await import("node:child_process");
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    await new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: "ignore", detached: true });
+        child.once("error", reject);
+        child.once("spawn", () => { child.unref(); resolve(); });
+    });
+}
+async function listenForCallback(expectedState, signal) {
+    signal?.throwIfAborted();
+    let resolve, reject;
+    const result = new Promise((res, rej) => { resolve = res; reject = rej; });
+    const server = createServer((request, response) => {
+        const url = new URL(request.url ?? "/", "http://127.0.0.1");
+        if (url.pathname !== "/auth/callback") {
+            response.writeHead(404).end();
+            return;
+        }
+        const state = url.searchParams.get("state") ?? undefined;
+        if (state !== expectedState) {
+            response.writeHead(400).end("Invalid OAuth state.");
+            reject(new Error("OAuth state validation failed."));
+            return;
+        }
+        const value = { state, code: url.searchParams.get("code") ?? undefined, client_id: url.searchParams.get("client_id") ?? undefined, error: url.searchParams.get("error") ?? undefined };
+        response.writeHead(value.error ? 400 : 200, { "content-type": "text/plain" }).end(value.error === "access_denied" ? "Sign-in was declined. You may close this window." : "Sign-in received. You may close this window.");
+        if (value.error)
+            reject(new Error(value.error === "access_denied" ? "Sign-in was declined." : `OpenAI authorization failed (${safeError(value.error)}).`));
+        else
+            resolve(value);
+    });
+    const timer = setTimeout(() => reject(new Error("OpenAI sign-in timed out. Run /login oauth openai to try again.")), 5 * 60_000);
+    timer.unref();
+    const abort = () => reject(new Error("OpenAI sign-in was cancelled."));
+    signal?.addEventListener("abort", abort, { once: true });
+    await new Promise((resolve, reject) => { server.once("error", reject); server.listen(0, "127.0.0.1", resolve); });
+    const address = server.address();
+    if (!address || typeof address === "string")
+        throw new Error("Could not start the local OAuth callback listener.");
+    return { redirectUri: `http://127.0.0.1:${address.port}/auth/callback`, result, close: () => { clearTimeout(timer); signal?.removeEventListener("abort", abort); server.close(); } };
+}
+async function getOrCreateHostId(file) {
+    const target = file ?? oauthFilePath();
+    const hostFile = path.join(path.dirname(target), "oauth-host-id");
+    try {
+        return (await readFile(hostFile, "utf8")).trim();
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        const id = `urn:uuid:${crypto.randomUUID()}`;
+        await mkdir(path.dirname(hostFile), { recursive: true, mode: 0o700 });
+        await writeFile(hostFile, `${id}\n`, { mode: 0o600, flag: "wx" });
+        return id;
+    }
+}
+async function verifyOpenAIIdToken(token, audience, nonce, fetcher) {
+    const [head, payload, signature] = token.split(".");
+    if (!head || !payload || !signature || token.split(".").length !== 3)
+        throw new Error("OpenAI returned a malformed ID token.");
+    let header;
+    try {
+        header = JSON.parse(Buffer.from(head, "base64url").toString());
+    }
+    catch {
+        throw new Error("OpenAI returned a malformed ID token.");
+    }
+    let claims;
+    try {
+        claims = JSON.parse(Buffer.from(payload, "base64url").toString());
+    }
+    catch {
+        throw new Error("OpenAI returned a malformed ID token.");
+    }
+    if (header.alg !== "RS256" || typeof header.kid !== "string")
+        throw new Error("OpenAI ID token uses an unsupported signing key.");
+    const discoveryResponse = await fetcher("https://auth.openai.com/.well-known/openid-configuration");
+    if (!discoveryResponse.ok)
+        throw new Error("Could not load OpenAI identity metadata.");
+    const discovery = await safeJson(discoveryResponse, "OpenAI identity metadata");
+    if (discovery.issuer !== "https://auth.openai.com" || !discovery.jwks_uri || new URL(discovery.jwks_uri).origin !== "https://auth.openai.com")
+        throw new Error("OpenAI identity metadata failed validation.");
+    const jwksResponse = await fetcher(discovery.jwks_uri);
+    if (!jwksResponse.ok)
+        throw new Error("Could not verify OpenAI ID token signing key.");
+    const jwks = await safeJson(jwksResponse, "OpenAI signing keys");
+    const jwk = jwks.keys?.find((key) => key.kid === header.kid);
+    if (!jwk)
+        throw new Error("OpenAI ID token signing key was not found.");
+    let valid = false;
+    try {
+        const key = createPublicKey({ key: jwk, format: "jwk" });
+        valid = verifySignature("RSA-SHA256", Buffer.from(`${head}.${payload}`), key, Buffer.from(signature, "base64url"));
+    }
+    catch {
+        throw new Error("OpenAI ID token signature validation failed.");
+    }
+    const aud = claims.aud;
+    if (!valid || claims.iss !== discovery.issuer || !(aud === audience || (Array.isArray(aud) && aud.includes(audience) && claims.azp === audience)) || claims.nonce !== nonce || typeof claims.exp !== "number" || claims.exp <= Date.now() / 1000 || (typeof claims.nbf === "number" && claims.nbf > Date.now() / 1000) || typeof claims.sub !== "string")
+        throw new Error("OpenAI ID token validation failed.");
+    return claims;
+}
+/** xAI RFC 8628 device login; endpoints/scopes currently follow public grok-cli OAuth metadata. */
+export async function signInXAI(options) {
+    options.signal?.throwIfAborted();
+    const fetcher = secureFetch(options.fetch ?? fetch, options.signal);
+    const clientId = "b1a00492-073a-47ea-816f-4c329264a828";
+    const discoveryResponse = await fetcher("https://auth.x.ai/.well-known/openid-configuration");
+    if (!discoveryResponse.ok)
+        throw new Error("Could not load xAI OAuth metadata.");
+    const discovery = await safeJson(discoveryResponse, "xAI OAuth metadata");
+    const tokenEndpoint = "https://auth.x.ai/oauth2/token";
+    const deviceEndpoint = "https://auth.x.ai/oauth2/device/code";
+    if (discovery.issuer !== "https://auth.x.ai" || discovery.token_endpoint !== tokenEndpoint || discovery.device_authorization_endpoint !== deviceEndpoint || !discovery.grant_types_supported?.includes("urn:ietf:params:oauth:grant-type:device_code") || !discovery.scopes_supported?.includes("api:access") || !discovery.scopes_supported.includes("offline_access"))
+        throw new Error("xAI OAuth metadata does not advertise the expected device-code flow and scopes.");
+    const response = await fetcher(discovery.device_authorization_endpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" }, body: new URLSearchParams({ client_id: clientId, scope: "openid profile email offline_access grok-cli:access api:access", referrer: "chivgent" }) });
+    const device = await safeJson(response, "xAI device authorization");
+    if (!response.ok || !device.device_code || !device.user_code || !device.verification_uri)
+        throw new Error(`xAI device authorization failed (${safeError(device.error)}).`);
+    const verification = new URL(device.verification_uri);
+    if (verification.protocol !== "https:" || !["x.ai", "auth.x.ai"].includes(verification.hostname) || verification.username || verification.password || /[\u0000-\u001f\u007f]/.test(device.verification_uri))
+        throw new Error("xAI returned an unexpected device verification URL.");
+    options.write(`Open ${device.verification_uri} and enter code ${device.user_code}\n`);
+    const expires = Date.now() + (device.expires_in ?? 900) * 1000;
+    let interval = device.interval ?? 5;
+    const delay = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    while (Date.now() < expires) {
+        if (options.signal?.aborted)
+            throw new Error("xAI sign-in was cancelled.");
+        await abortableDelay(interval * 1000, delay, options.signal);
+        const polled = await fetcher(discovery.token_endpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" }, body: new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:device_code", client_id: clientId, device_code: device.device_code }) });
+        const token = await safeJson(polled, "xAI token polling");
+        if (polled.ok && token.access_token) {
+            validateTokenFields(token, "xai", false);
+            const granted = token.scope?.split(" ") ?? [];
+            if (!token.refresh_token || (!granted.includes("api:access") && !granted.includes("grok-cli:access")))
+                throw new Error("xAI did not grant renewable Grok API access.");
+            const credential = { type: "oauth", provider: "xai", clientId, accessToken: token.access_token, ...(token.refresh_token ? { refreshToken: token.refresh_token } : {}), expiresAt: Date.now() + (token.expires_in ?? 3600) * 1000, scopes: token.scope?.split(" ") ?? [] };
+            await writeOAuthCredential(credential, options.file);
+            return credential;
+        }
+        if (token.error === "authorization_pending")
+            continue;
+        if (token.error === "slow_down") {
+            interval += 5;
+            continue;
+        }
+        if (token.error === "access_denied")
+            throw new Error("xAI sign-in was declined.");
+        if (token.error === "expired_token")
+            throw new Error("xAI device code expired. Run /login xai again.");
+        if (!polled.ok)
+            throw new Error(`xAI token polling failed (${safeError(token.error)}).`);
+    }
+    throw new Error("xAI device code expired. Run /login xai again.");
+}
+async function abortableDelay(ms, delay, signal) {
+    if (!signal)
+        return delay(ms);
+    if (signal.aborted)
+        throw new Error("xAI sign-in was cancelled.");
+    let cancel;
+    const aborted = new Promise((_, reject) => { cancel = () => reject(new Error("xAI sign-in was cancelled.")); signal.addEventListener("abort", cancel, { once: true }); });
+    try {
+        await Promise.race([delay(ms), aborted]);
+    }
+    finally {
+        signal.removeEventListener("abort", cancel);
+    }
+}
+function secureFetch(fetcher, outerSignal) {
+    return (input, init = {}) => fetcher(input, { ...init, redirect: "error", signal: AbortSignal.any([...(init.signal ? [init.signal] : []), ...(outerSignal ? [outerSignal] : []), AbortSignal.timeout(15_000)]) });
+}
+/** OAuth bearer tokens may only reach their provider API; reject redirects too. */
+export function oauthApiFetch(expectedOrigin) {
+    return (input, init = {}) => {
+        let url;
+        try {
+            url = new URL(input instanceof Request ? input.url : input instanceof URL ? input.toString() : String(input));
+        }
+        catch {
+            throw new Error("OAuth API request had an invalid URL.");
+        }
+        if (url.origin !== expectedOrigin)
+            throw new Error("OAuth API request target failed origin validation.");
+        return fetch(input, { ...init, redirect: "error" });
+    };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AAClG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAgB7B,MAAM,UAAU,aAAa,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;AACnD,KAAK,UAAU,YAAY,CAAI,IAAY,EAAE,MAAwB;IACnE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1D,IAAI,OAAoB,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACzC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5B,MAAM,QAAQ,CAAC;IACf,IAAI,UAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACrC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC5C,IAAI,CAAC;gBAAC,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;YACvD,OAAO,KAAK,EAAE,CAAC;gBACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBACpE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,QAAQ,0EAA0E,CAAC,CAAC;QACtL,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;YACO,CAAC;QACP,IAAI,UAAU,EAAE,CAAC;YAAC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAClG,OAAO,EAAE,CAAC;QAAC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM;YAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAI,GAAG,aAAa,EAAE;IAC/D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,qBAAqB,CAAC,CAAC;QAAC,CAAC;QACxH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACvF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,uEAAuE,CAAC,CAAC;QAC7K,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAA2B,EAAE,IAAI,GAAG,aAAa,EAAE;IAC5F,OAAO,YAAY,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,4BAA4B,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,UAA2B,EAAE,IAAY;IACnF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtB,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC5E,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3G,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAqC,EAAE,IAAI,GAAG,aAAa,EAAE;IACvG,OAAO,YAAY,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,6BAA6B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,QAAqC,EAAE,IAAY;IAC9F,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAClE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC5E,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3G,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,QAAqC,EAAE,IAAI,GAAG,aAAa,EAAE,EAAE,OAAO,GAAiB,KAAK,EAAE,MAAoB;IAClK,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,OAAO,YAAY,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC9F,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YAAE,OAAO,OAAO,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,CAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC7F,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC7K,MAAM,4BAA4B,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAA2B,EAAE,OAAO,GAAiB,KAAK,EAAE,MAAoB;IAC3H,IAAI,CAAC,UAAU,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,CAAC,QAAQ,kBAAkB,CAAC,CAAC;IAC1H,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,KAAK,QAAQ;QAC/C,CAAC,CAAC,kDAAkD;QACpD,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ;QAC5F,aAAa,EAAE,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpI,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACtL,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAgB,QAAQ,EAAE,eAAe,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACtJ,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY;QACjH,OAAO,EAAE,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;QACtG,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAqB,EAAE,MAAoB;IAC5E,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,oDAAoD,CAAC,CAAC;IAC1G,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAA+C,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC9G,IAAI,QAAQ,CAAC,MAAM,KAAK,mBAAmB,IAAI,QAAQ,CAAC,cAAc,KAAK,gCAAgC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACrL,OAAO,QAAQ,CAAC,cAAc,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAA2B,EAAE,OAAO,GAAiB,KAAK;IACpG,IAAI,CAAC,UAAU,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAClG,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAC;QAChF,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,EAAsC,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,mBAAmB,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QAC3G,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QACtR,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAGD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,uBAAuB,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,yBAAyB,CAAC,CAAC,CAAC;AAC7M,SAAS,SAAS,CAAC,KAAc,IAAY,OAAO,KAAK,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AACpH,KAAK,UAAU,QAAQ,CAAI,QAAkB,EAAE,KAAa;IAC1D,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3F,OAAO,KAAU,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,YAAY,CAAC,CAAC;IAAC,CAAC;AACpE,CAAC;AACD,SAAS,mBAAmB,CAAC,KAAoB,EAAE,QAAqC,EAAE,oBAA6B;IACrH,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE;QACpE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QACvH,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC1L,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClK,IAAI,oBAAoB,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACrS,CAAC;AACD,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;QAC5E,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACxH,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC7E,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;AACrH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,IAAY,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAC9E,SAAS,WAAW,KAAa,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAElE,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA0P;IAC3R,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,CAAC,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvG,MAAM,KAAK,GAAG,WAAW,EAAE,EAAE,KAAK,GAAG,WAAW,EAAE,EAAE,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,gDAAgD,CAAC,CAAC;IACvE,MAAM,UAAU,GAA2B,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI,sBAAsB;QAClG,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,WAAW;QACpF,KAAK,EAAE,+EAA+E;QACtF,QAAQ,EAAE,2BAA2B,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;IAClH,IAAI,QAAQ,KAAK,SAAS;QAAE,UAAU,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;SACpE,CAAC;QACJ,IAAI,QAAQ,CAAC,OAAO;YAAE,UAAU,CAAC,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC;QAClE,IAAI,QAAQ,CAAC,KAAK;YAAE,UAAU,CAAC,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,WAAW;YAAE,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;;YAC/D,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACrC,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,IAAI,QAAQ,EAAE,QAAQ,CAAC;QACxD,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gCAAgC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5J,IAAI,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACrK,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACxJ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,kDAAkD,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,EAAE,2BAA2B,EAAE,CAAC,EAAE,CAAC,CAAC;QAClZ,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAgB,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzI,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACxM,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACrF,IAAI,QAAQ,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC3J,MAAM,UAAU,GAAoB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY;YAChH,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ;YAC9F,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAa;YAC3H,GAAG,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7E,MAAM,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,UAAU,CAAC;IACpB,CAAC;YAAS,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3G,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAGD,KAAK,UAAU,iBAAiB,CAAC,aAAqB,EAAE,MAAoB;IAC1E,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,IAAI,OAAyC,EAAE,MAA+B,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,OAAO,CAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACjF,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;QACzD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAClJ,MAAM,KAAK,GAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;QACvM,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC;QACzN,IAAI,KAAK,CAAC,KAAK;YAAE,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gCAAgC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;;YAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAClL,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;IACjI,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACnH,OAAO,EAAE,WAAW,EAAE,oBAAoB,OAAO,CAAC,IAAI,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAa;IAC5C,MAAM,MAAM,GAAG,IAAI,IAAI,aAAa,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;IAClE,IAAI,CAAC;QAAC,OAAO,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;IACzD,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACpE,MAAM,EAAE,GAAG,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAa,EAAE,OAAqB;IACtG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC/H,IAAI,MAAsC,CAAC;IAC3C,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAmC,CAAC;IAAC,CAAC;IACzG,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAAC,CAAC;IACnE,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAA4B,CAAC;IAAC,CAAC;IACrG,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAAC,CAAC;IACnE,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAClI,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,0DAA0D,CAAC,CAAC;IACpG,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAyC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IACxH,IAAI,SAAS,CAAC,MAAM,KAAK,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,yBAAyB;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC9M,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAkD,YAAY,EAAE,qBAAqB,CAAC,CAAC;IAClH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACxE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,KAAK,GAAG,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACrH,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAChZ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA4I;IAC1K,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,sCAAsC,CAAC;IACxD,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,oDAAoD,CAAC,CAAC;IAC9F,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAsJ,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAC/N,MAAM,aAAa,GAAG,gCAAgC,CAAC;IACvD,MAAM,cAAc,GAAG,sCAAsC,CAAC;IAC9D,IAAI,SAAS,CAAC,MAAM,KAAK,mBAAmB,IAAI,SAAS,CAAC,cAAc,KAAK,aAAa,IAAI,SAAS,CAAC,6BAA6B,KAAK,cAAc,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,QAAQ,CAAC,8CAA8C,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IAC5c,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,gEAAgE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7U,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAkI,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IACrM,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3K,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACtD,IAAI,YAAY,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACpR,OAAO,CAAC,KAAK,CAAC,QAAQ,MAAM,CAAC,gBAAgB,mBAAmB,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;IAC/D,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC3E,MAAM,cAAc,CAAC,QAAQ,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,8CAA8C,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1T,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAgB,MAAM,EAAE,mBAAmB,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,EAAE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACpC,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YACvK,MAAM,UAAU,GAAoB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3R,MAAM,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO,UAAU,CAAC;QAC1E,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QACtD,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAAC,QAAQ,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACvG,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,EAAU,EAAE,KAAoC,EAAE,MAAoB;IAClG,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClE,IAAI,MAAmB,CAAC;IACxB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjL,IAAI,CAAC;QAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,CAAC;YACzC,CAAC;QAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,OAAqB,EAAE,WAAyB;IACnE,OAAO,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACpN,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,cAAsB;IAClD,OAAO,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;QAC1B,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAC,CAAC;QACtH,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAAC,CAAC;QACnE,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACzG,OAAO,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC;AACJ,CAAC"}

package/dist/cli-options.d.ts

@@ -1,5 +1,7 @@
 export declare const VERSION: string;
 import { ProviderRegistry } from "./providers/registry.js";
+import type { ShellBackend } from "./shell/factory.js";
+import { type PermissionMode } from "./permissions.js";
 /** A Provider id known to the registry. */
 export type Provider = string;
 export declare const DEFAULT_MAX_TURNS = 8;
@@ -34,13 +36,14 @@ export interface CliOptions {
     readonly listSessions: boolean;
     /** Allow the agent to create and modify files in the workspace. */
     readonly allowWrites: boolean;
-    /**
-     * Allow the agent to run shell commands. This implies write access: a shell
-     * can do everything the write tools can and is not bound by the workspace.
-     */
+    /** Allow the agent to run shell commands inside the selected sandbox. */
     readonly allowShell: boolean;
-    /** Explicitly approve every command in this session; Docker isolation still applies. */
+    /** Explicitly approve every command in this session; sandbox isolation still applies. */
     readonly approveAllShell: boolean;
+    readonly shellBackend: ShellBackend;
+    readonly shellNetwork: boolean;
+    /** Explicit policy for tool approval boundaries; absent preserves legacy flags. */
+    readonly permissionMode?: PermissionMode;
     /** Draw a live status region above the prompt. Interactive terminals only. */
     readonly tui: boolean;
     /** Load extensions from the user and (once trusted) the project directory. */

package/dist/cli-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-options.d.ts","sourceRoot":"","sources":["../src/cli-options.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,OAAO,QAC6D,CAAC;AAElF,OAAO,EAEL,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AAGjC,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAI1C;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC;AAE/C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,uCAAuC;IACvC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,EAAE,cAAc,EAC3B,QAAQ,GAAE,gBAA0C,GACnD,UAAU,CAyJZ;AAED,wBAAgB,QAAQ,CACtB,QAAQ,GAAE,gBAA0C,GACnD,MAAM,CA2DR"}
+{"version":3,"file":"cli-options.d.ts","sourceRoot":"","sources":["../src/cli-options.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,OAAO,QAC6D,CAAC;AAElF,OAAO,EAEL,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE5E,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAI1C;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC;AAE/C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,uCAAuC;IACvC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,EAAE,cAAc,EAC3B,QAAQ,GAAE,gBAA0C,GACnD,UAAU,CAkLZ;AAED,wBAAgB,QAAQ,CACtB,QAAQ,GAAE,gBAA0C,GACnD,MAAM,CA8DR"}

package/dist/cli-options.js

@@ -4,6 +4,7 @@ const packageMetadata = require("../package.json");
 export const VERSION = typeof packageMetadata.version === "string" ? packageMetadata.version : "0.0.0";
 import { defaultProviderRegistry, ProviderRegistry, } from "./providers/registry.js";
 import { DEFAULT_CONTEXT_WINDOW } from "./context/context-manager.js";
+import { parsePermissionMode } from "./permissions.js";
 export const DEFAULT_MAX_TURNS = 8;
 /**
  * Editing costs turns that reading does not: the model reads, edits, then
@@ -30,6 +31,9 @@ export function parseCliArgs(argv, environment, registry = defaultProviderRegist
     let allowWrites = false;
     let allowShell = false;
     let approveAllShell = false;
+    let shellBackend = "auto";
+    let shellNetwork = false;
+    let permissionMode;
     let tui = false;
     let extensions = true;
     let serve = false;
@@ -107,6 +111,20 @@ export function parseCliArgs(argv, environment, registry = defaultProviderRegist
         else if (argument === "--approve-all-shell") {
             approveAllShell = true;
         }
+        else if (argument === "--shell-backend") {
+            const value = readOptionValue(argv, index, "--shell-backend");
+            if (value !== "auto" && value !== "native" && value !== "docker")
+                throw new TypeError("--shell-backend must be auto, native, or docker.");
+            shellBackend = value;
+            index += 1;
+        }
+        else if (argument === "--shell-network") {
+            shellNetwork = true;
+        }
+        else if (argument === "--permission-mode") {
+            permissionMode = parsePermissionMode(readOptionValue(argv, index, "--permission-mode"));
+            index += 1;
+        }
         else if (argument === "--serve") {
             serve = true;
         }
@@ -147,6 +165,15 @@ export function parseCliArgs(argv, environment, registry = defaultProviderRegist
     if (approveAllShell && !allowShell) {
         throw new TypeError("--approve-all-shell requires --allow-shell.");
     }
+    if (permissionMode !== undefined && (allowWrites || allowShell || approveAllShell || shellNetwork)) {
+        throw new TypeError("--permission-mode cannot be combined with --allow-writes, --allow-shell, --approve-all-shell, or --shell-network; select the complete policy mode instead.");
+    }
+    if (permissionMode !== undefined && connect !== undefined) {
+        throw new TypeError("--permission-mode applies to local sessions and cannot be used with --connect.");
+    }
+    if (permissionMode !== undefined && serve) {
+        throw new TypeError("--permission-mode cannot be used with --serve because served sessions do not have an interactive approval channel.");
+    }
     const definition = registry.get(provider);
     const model = requestedModel ||
         firstEnvironmentValue(environment, definition.modelEnvKeys) ||
@@ -158,7 +185,7 @@ export function parseCliArgs(argv, environment, registry = defaultProviderRegist
         provider,
         ...(model === undefined ? {} : { model }),
         ...(baseURL === undefined ? {} : { baseURL }),
-        maxTurns: (allowWrites || allowShell) && !maxTurnsExplicit
+        maxTurns: (allowWrites || allowShell || permissionMode !== undefined) && !maxTurnsExplicit
             ? DEFAULT_WRITE_MAX_TURNS
             : maxTurns,
         stream,
@@ -171,6 +198,9 @@ export function parseCliArgs(argv, environment, registry = defaultProviderRegist
         allowWrites,
         allowShell,
         approveAllShell,
+        shellBackend,
+        shellNetwork,
+        ...(permissionMode === undefined ? {} : { permissionMode }),
         tui,
         extensions,
         serve,
@@ -206,9 +236,12 @@ Options:
   --resume ID      Resume a specific session
   --sessions       List recorded sessions and exit
   --allow-writes   Let the agent create and change files (default: read-only)
-  --allow-shell    Expose bash inside an offline Docker container (Docker required).
+  --allow-shell    Expose bash inside a native macOS sandbox or Docker (network denied).
                    Interactive commands require individual confirmation.
-  --approve-all-shell  Explicitly approve all Docker shell commands this session;
+  --shell-backend MODE  auto, native, or docker (default: auto; macOS uses native).
+  --shell-network  Allow shell network access (explicit opt-in for either backend).
+  --permission-mode MODE  ask-first, workspace, or unrestricted (network enabled).
+  --approve-all-shell  Explicitly approve all shell commands this session;
                    use only with --allow-shell when individual prompts are unavailable.
   --serve          Expose this session on a local socket and keep running
   --connect TARGET Attach to a served session, by id or socket path