icoa-cli 2.19.357 → 2.19.359

package/dist/lib/sandbox.js

@@ -1,144 +1 @@
-import { execSync, spawn } from 'node:child_process';
-import chalk from 'chalk';
-import { isDockerRunning } from './docker-probe.js';
-/**
- * Sandbox images, newest first. `2026.1` bakes the aienv ML venv (core+data+
- * physics groups, mujoco==3.9.0 judge-parity pin) at ~/.icoa/aienv — the same
- * path `aienv setup` provisions on a host — so arena / self_check / notebook
- * flows work inside the container without teams self-installing an ML stack
- * that drifts from the server judge (the 2026-07 finals feedback). The legacy
- * `2026` tag stays as a fallback so the sandbox keeps working for users who
- * only have (or can only reach) the old image.
- */
-export const SANDBOX_IMAGES = ['icoa/sandbox:2026.1', 'icoa/sandbox:2026'];
-/**
- * Pick the sandbox image: any LOCAL image first (offline-graceful — never block
- * a session on a multi-GB pull when a working sandbox is already on disk), then
- * pull newest-first. null → caller decides the fallback (host shell / local
- * build). Probes are injected so the ladder stays pure + unit-tested (tests
- * live in test/shell-sandbox-mounts.test.js via the shell.ts re-export).
- */
-export function resolveSandboxImage(hasLocal, pull, images = SANDBOX_IMAGES) {
-    for (const image of images)
-        if (hasLocal(image))
-            return image;
-    for (const image of images)
-        if (pull(image))
-            return image;
-    return null;
-}
-const CONTAINER = 'icoa-sandbox';
-/**
- * Is Docker usable right now? Probes the daemon socket directly (never the
- * `docker` CLI) so a stopped Docker Desktop is NOT auto-started — the sandbox
- * is optional and the host shell is the fallback, so merely *checking* must not
- * wake Docker. See lib/docker-probe.ts.
- */
-export async function isDockerAvailable() {
-    return isDockerRunning();
-}
-function isSandboxRunning() {
-    try {
-        const out = execSync(`docker inspect -f '{{.State.Running}}' ${CONTAINER} 2>/dev/null`, {
-            encoding: 'utf-8',
-        });
-        return out.trim() === 'true';
-    }
-    catch {
-        return false;
-    }
-}
-export async function ensureSandbox() {
-    if (!(await isDockerAvailable())) {
-        console.log(chalk.yellow('  Docker not found. Install Docker Desktop to use sandbox tools.'));
-        console.log(chalk.gray('  https://www.docker.com/products/docker-desktop'));
-        return false;
-    }
-    if (isSandboxRunning())
-        return true;
-    // Check if container exists but stopped
-    try {
-        execSync(`docker start ${CONTAINER}`, { stdio: 'ignore' });
-        return true;
-    }
-    catch {
-        // Container doesn't exist, create it
-    }
-    // Resolve an image via the ladder: local-first, then pull newest-first.
-    const hasLocal = (image) => {
-        try {
-            execSync(`docker image inspect ${image}`, { stdio: 'ignore' });
-            return true;
-        }
-        catch {
-            return false;
-        }
-    };
-    const pull = (image) => {
-        console.log(chalk.gray(`  Pulling ${image} (first time only)...`));
-        try {
-            execSync(`docker pull ${image}`, { stdio: 'inherit' });
-            return true;
-        }
-        catch {
-            return false;
-        }
-    };
-    let image = resolveSandboxImage(hasLocal, pull);
-    if (!image) {
-        // Nothing pullable — build the derived 2026.1 locally (Dockerfile.aienv
-        // pulls the frozen CTF base `2026` itself as its FROM). We never rebuild
-        // the base from scratch: its 27 exact-pinned libs are integrity-frozen.
-        console.log(chalk.gray('  Building sandbox from local Dockerfile.aienv...'));
-        try {
-            const dockerDir = new URL('../../docker', import.meta.url).pathname;
-            execSync(`docker build -f ${dockerDir}/Dockerfile.aienv -t ${SANDBOX_IMAGES[0]} ${dockerDir}`, {
-                stdio: 'inherit',
-            });
-            image = SANDBOX_IMAGES[0];
-        }
-        catch {
-            console.log(chalk.red('  Failed to set up sandbox.'));
-            return false;
-        }
-    }
-    // Create and start container
-    try {
-        execSync(`docker run -d --name ${CONTAINER} ` +
-            `-v icoa-challenges:/home/competitor/challenges ` +
-            // Default bridge network, NOT `--network host`. Host networking shares
-            // the contestant's network namespace, so sandboxed solve-code could reach
-            // services bound to the host's 127.0.0.1 (internal eval/admin endpoints).
-            // Bridge still allows outbound to remote challenge targets + internet via
-            // NAT — only host-localhost is cut off, which no legitimate practical
-            // needs. See B9 in docs/POST_COMPETITION_AUDIT_STANDARD.md §10.
-            // KNOWN FOLLOW-UP (B9, deferred): the single shared `icoa-challenges`
-            // volume lets one challenge's code read another's files. Per-task
-            // ephemeral volumes need reworking the persistent-container model.
-            `--network bridge ` +
-            `${image} sleep infinity`, { stdio: 'ignore' });
-        return true;
-    }
-    catch {
-        console.log(chalk.red('  Failed to start sandbox container.'));
-        return false;
-    }
-}
-export function runInSandbox(command, rl) {
-    return new Promise((resolve) => {
-        rl.pause();
-        const opts = {
-            stdio: 'inherit',
-            shell: true,
-        };
-        const child = spawn('docker', ['exec', '-it', CONTAINER, 'bash', '-c', command], opts);
-        child.on('close', () => {
-            rl.resume();
-            resolve();
-        });
-        child.on('error', () => {
-            rl.resume();
-            resolve();
-        });
-    });
-}
+import{execSync as o,spawn as e}from"node:child_process";import chalk from"chalk";import{isDockerRunning as r}from"./docker-probe.js";export const SANDBOX_IMAGES=["icoa/sandbox:2026.1","icoa/sandbox:2026"];export function resolveSandboxImage(o,e,r=SANDBOX_IMAGES){for(const e of r)if(o(e))return e;for(const o of r)if(e(o))return o;return null}const t="icoa-sandbox";export async function isDockerAvailable(){return r()}export async function ensureSandbox(){if(!await isDockerAvailable())return console.log(chalk.yellow("  Docker not found. Install Docker Desktop to use sandbox tools.")),console.log(chalk.gray("  https://www.docker.com/products/docker-desktop")),!1;if(function(){try{return"true"===o(`docker inspect -f '{{.State.Running}}' ${t} 2>/dev/null`,{encoding:"utf-8"}).trim()}catch{return!1}}())return!0;try{return o(`docker start ${t}`,{stdio:"ignore"}),!0}catch{}let e=resolveSandboxImage(e=>{try{return o(`docker image inspect ${e}`,{stdio:"ignore"}),!0}catch{return!1}},e=>{console.log(chalk.gray(`  Pulling ${e} (first time only)...`));try{return o(`docker pull ${e}`,{stdio:"inherit"}),!0}catch{return!1}});if(!e){console.log(chalk.gray("  Building sandbox from local Dockerfile.aienv..."));try{const r=new URL("../../docker",import.meta.url).pathname;o(`docker build -f ${r}/Dockerfile.aienv -t ${SANDBOX_IMAGES[0]} ${r}`,{stdio:"inherit"}),e=SANDBOX_IMAGES[0]}catch{return console.log(chalk.red("  Failed to set up sandbox.")),!1}}try{return o(`docker run -d --name ${t} -v icoa-challenges:/home/competitor/challenges --network bridge ${e} sleep infinity`,{stdio:"ignore"}),!0}catch{return console.log(chalk.red("  Failed to start sandbox container.")),!1}}export function runInSandbox(o,r){return new Promise(n=>{r.pause();const c=e("docker",["exec","-it",t,"bash","-c",o],{stdio:"inherit",shell:!0});c.on("close",()=>{r.resume(),n()}),c.on("error",()=>{r.resume(),n()})})}

package/dist/lib/shell-split.js

@@ -1,69 +1 @@
-/**
- * shellSplit — a minimal, quote-aware tokenizer for REPL commands that forward
- * raw args straight to a child process (currently `aienv run` / `aienv python`).
- *
- * The icoa REPL is NOT a shell: the default command split on /\s+/ turns quotes
- * into literal characters and tears spaced args apart, so `aienv run "my file.py"`
- * and `aienv python -c "print(1 + 1)"` reach python mangled. This honours
- * single/double quotes (and backslash escapes inside double quotes / outside
- * quotes) the way a real shell would tokenize them. (Direct-CLI invocation never
- * needs this — there the system shell does the tokenization for us.)
- *
- * Scope is deliberately small: word-splitting + quote removal + backslash
- * escapes. No globbing, no variable/`$()` expansion, no `~` expansion — the
- * child process / caller handles paths, and we explicitly do not want shell
- * metacharacter semantics in the REPL.
- */
-export function shellSplit(input) {
-    const tokens = [];
-    let cur = '';
-    let inSingle = false;
-    let inDouble = false;
-    let hasTok = false; // so an explicit "" / '' still yields an empty-string arg
-    for (let i = 0; i < input.length; i++) {
-        const c = input[i];
-        if (inSingle) {
-            // Inside single quotes everything is literal until the closing quote.
-            if (c === "'")
-                inSingle = false;
-            else
-                cur += c;
-            hasTok = true;
-        }
-        else if (inDouble) {
-            if (c === '"')
-                inDouble = false;
-            else if (c === '\\' && (input[i + 1] === '"' || input[i + 1] === '\\'))
-                cur += input[++i];
-            else
-                cur += c;
-            hasTok = true;
-        }
-        else if (c === "'") {
-            inSingle = true;
-            hasTok = true;
-        }
-        else if (c === '"') {
-            inDouble = true;
-            hasTok = true;
-        }
-        else if (c === '\\' && i + 1 < input.length) {
-            cur += input[++i];
-            hasTok = true;
-        }
-        else if (/\s/.test(c)) {
-            if (hasTok) {
-                tokens.push(cur);
-                cur = '';
-                hasTok = false;
-            }
-        }
-        else {
-            cur += c;
-            hasTok = true;
-        }
-    }
-    if (hasTok)
-        tokens.push(cur);
-    return tokens;
-}
+export function shellSplit(t){const e=[];let l="",n=!1,s=!1,h=!1;for(let o=0;o<t.length;o++){const p=t[o];n?("'"===p?n=!1:l+=p,h=!0):s?('"'===p?s=!1:"\\"!==p||'"'!==t[o+1]&&"\\"!==t[o+1]?l+=p:l+=t[++o],h=!0):"'"===p?(n=!0,h=!0):'"'===p?(s=!0,h=!0):"\\"===p&&o+1<t.length?(l+=t[++o],h=!0):/\s/.test(p)?h&&(e.push(l),l="",h=!1):(l+=p,h=!0)}return h&&e.push(l),e}

package/dist/lib/sim-cooldown.js

@@ -1,75 +1 @@
-/**
- * Shared 60s cooldown for any client-side caller of the MuJoCo sim
- * endpoint (`/api/ai/vla/41/sim`). Both `icoa sim <scenario>` and
- * `icoa demo2`'s parameter mode hit the same render pipeline; the
- * cooldown lives in a file so they share one budget.
- *
- * Why: render is CPU-heavy shared infrastructure. 60s/student keeps
- * concurrent load survivable.
- *
- * Two additional fields piggy-back on the same file so demo2 can detect
- * what a user has already experienced (bundled dance / interactive arm).
- * These do NOT gate anything — they are continuity signals only.
- */
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { homedir } from 'node:os';
-export const COOLDOWN_SECONDS = 60;
-const COOLDOWN_FILE = join(homedir(), '.icoa', 'sim-cooldown.json');
-function readFile() {
-    try {
-        const raw = readFileSync(COOLDOWN_FILE, 'utf-8');
-        const j = JSON.parse(raw);
-        return typeof j === 'object' && j !== null ? j : {};
-    }
-    catch {
-        return {};
-    }
-}
-function writeMerge(patch) {
-    try {
-        mkdirSync(join(homedir(), '.icoa'), { recursive: true });
-        const merged = { ...readFile(), ...patch };
-        writeFileSync(COOLDOWN_FILE, JSON.stringify(merged));
-    }
-    catch {
-        // Non-fatal: cooldown is convenience, not security
-    }
-}
-export function lastSimAt() {
-    const f = readFile();
-    return typeof f.lastCallAt === 'number' ? f.lastCallAt : 0;
-}
-export function markSimAt(t) {
-    writeMerge({ lastCallAt: t });
-}
-/** Seconds remaining (0 if clear). */
-export function cooldownRemaining() {
-    const since = (Date.now() - lastSimAt()) / 1000;
-    return Math.max(0, Math.ceil(COOLDOWN_SECONDS - since));
-}
-// ─── Continuity signals (not used for gating) ────────────────────────────
-export function lastBundledAt() {
-    const f = readFile();
-    return typeof f.lastBundledAt === 'number' ? f.lastBundledAt : 0;
-}
-export function markBundledAt(t) {
-    writeMerge({ lastBundledAt: t });
-}
-export function lastArmAt() {
-    const f = readFile();
-    return typeof f.lastArmAt === 'number' ? f.lastArmAt : 0;
-}
-export function markArmAt(t) {
-    writeMerge({ lastArmAt: t });
-}
-/**
- * Has the user seen any sim render — bundled, server, or arm — at least once?
- * Used by demo2 + boot screen to switch from "first time" to "continue" copy.
- */
-export function hasAnySimHistory() {
-    const f = readFile();
-    return ((typeof f.lastBundledAt === 'number' && f.lastBundledAt > 0) ||
-        (typeof f.lastCallAt === 'number' && f.lastCallAt > 0) ||
-        (typeof f.lastArmAt === 'number' && f.lastArmAt > 0));
-}
+import{mkdirSync as t,readFileSync as n,writeFileSync as o}from"node:fs";import{join as r}from"node:path";import{homedir as e}from"node:os";export const COOLDOWN_SECONDS=60;const l=r(e(),".icoa","sim-cooldown.json");function a(){try{const t=n(l,"utf-8"),o=JSON.parse(t);return"object"==typeof o&&null!==o?o:{}}catch{return{}}}function s(n){try{t(r(e(),".icoa"),{recursive:!0});const s={...a(),...n};o(l,JSON.stringify(s))}catch{}}export function lastSimAt(){const t=a();return"number"==typeof t.lastCallAt?t.lastCallAt:0}export function markSimAt(t){s({lastCallAt:t})}export function cooldownRemaining(){const t=(Date.now()-lastSimAt())/1e3;return Math.max(0,Math.ceil(60-t))}export function lastBundledAt(){const t=a();return"number"==typeof t.lastBundledAt?t.lastBundledAt:0}export function markBundledAt(t){s({lastBundledAt:t})}export function lastArmAt(){const t=a();return"number"==typeof t.lastArmAt?t.lastArmAt:0}export function markArmAt(t){s({lastArmAt:t})}export function hasAnySimHistory(){const t=a();return"number"==typeof t.lastBundledAt&&t.lastBundledAt>0||"number"==typeof t.lastCallAt&&t.lastCallAt>0||"number"==typeof t.lastArmAt&&t.lastArmAt>0}

package/dist/lib/theme.js

@@ -1,119 +1 @@
-// Unified Darcula terminal theme — works across macOS Terminal.app, iTerm2,
-// GNOME Terminal, Konsole, Windows Terminal (cmd/PowerShell/WSL).
-//
-// Three mechanisms are combined so every modern terminal gets the best it can:
-//
-//   1. OSC 10/11/12 sets the terminal's *default* fg/bg/cursor colors.
-//      Honored by iTerm2, GNOME Terminal, Konsole, Windows Terminal → lossless
-//      background, no scrollback or resize artifacts. Ignored by Terminal.app.
-//
-//   2. SGR 38;2/48;2 + \x1b[2J paints with 24-bit truecolor Darcula on every
-//      terminal that supports truecolor. This is the default path.
-//
-//   3. SGR 38;5/48;5 + \x1b[2J paints with 256-color approximation on macOS
-//      Terminal.app. Terminal.app does NOT support truecolor SGR and mis-parses
-//      `\x1b[48;2;43;43;43m` as a sequence of 16-color codes — the trailing
-//      `43` becomes ANSI "bg yellow", which is why v2.19.23/24 rendered with a
-//      yellow background there. Color 235 ≈ #262626 (dark gray, ~#2B2B2B) and
-//      color 250 ≈ #BCBCBC (light gray, ~#A9B7C6) are close enough.
-//
-// Legacy cmd.exe (pre-Win10 1809) can't run Node 22 anyway, so no separate
-// fallback path is needed.
-const OSC_INIT_DARK = '\x1b]10;#A9B7C6\x07' + // default fg
-    '\x1b]11;#2B2B2B\x07' + // default bg
-    '\x1b]12;#A9B7C6\x07'; // cursor color
-// High-contrast: pure black bg + pure white fg. For students with low vision
-// or screens where Darcula's subtle grays wash out (e.g., projectors, cheap
-// LCDs under fluorescent light). Still works with existing chalk colors —
-// cyan/green/yellow/red all show up clearly against pure black.
-const OSC_INIT_HC = '\x1b]10;#FFFFFF\x07' + '\x1b]11;#000000\x07' + '\x1b]12;#FFFFFF\x07';
-const OSC_RESET = '\x1b]110\x07' + // reset default fg
-    '\x1b]111\x07' + // reset default bg
-    '\x1b]112\x07'; // reset cursor color
-const SGR_INIT_TRUECOLOR_DARK = '\x1b[38;2;169;183;198m' + // fg #A9B7C6
-    '\x1b[48;2;43;43;43m' + // bg #2B2B2B
-    '\x1b[2J' +
-    '\x1b[H';
-const SGR_INIT_256_DARK = '\x1b[38;5;250m' + // fg ≈ #BCBCBC
-    '\x1b[48;5;235m' + // bg ≈ #262626
-    '\x1b[2J' +
-    '\x1b[H';
-const SGR_INIT_TRUECOLOR_HC = '\x1b[38;2;255;255;255m' + // fg pure white
-    '\x1b[48;2;0;0;0m' + // bg pure black
-    '\x1b[2J' +
-    '\x1b[H';
-const SGR_INIT_256_HC = '\x1b[38;5;231m' + // fg white (231 = pure white in 256)
-    '\x1b[48;5;16m' + // bg black (16 = pure black in 256)
-    '\x1b[2J' +
-    '\x1b[H';
-const SGR_RESET = '\x1b[0m\x1b[2J\x1b[H';
-function supportsAnsi() {
-    if (!process.stdout.isTTY)
-        return false;
-    const depth = process.stdout.getColorDepth?.();
-    if (typeof depth === 'number')
-        return depth >= 8;
-    return true;
-}
-// When icoa-cli runs inside the ICOA Terminal (Tauri + xterm.js), the host is
-// already pre-themed to the exact Darcula palette we'd be setting. Every OSC
-// and SGR we'd emit is a no-op in terms of color, but the \x1b[2J inside our
-// init/reset sequences would clear the grid visibly. Skip the paint entirely
-// in that environment so the banner simply appears in the shell cursor
-// position and scrollback is preserved on exit.
-function isIcoaTerminal() {
-    return process.env.ICOA_TERMINAL === '1';
-}
-// macOS Terminal.app does not implement SGR truecolor (\x1b[38;2;… / \x1b[48;2;…)
-// and mis-parses those sequences as 16-color codes, producing e.g. a yellow bg.
-// Detect it and fall back to 256-color SGR which Terminal.app handles correctly.
-function isAppleTerminal() {
-    return process.env.TERM_PROGRAM === 'Apple_Terminal';
-}
-let armed = false;
-export function setTerminalTheme(variant = 'dark') {
-    if (!supportsAnsi())
-        return;
-    if (isIcoaTerminal())
-        return; // host is already Darcula; nothing to do
-    const osc = variant === 'high-contrast' ? OSC_INIT_HC : OSC_INIT_DARK;
-    const sgr = isAppleTerminal()
-        ? variant === 'high-contrast'
-            ? SGR_INIT_256_HC
-            : SGR_INIT_256_DARK
-        : variant === 'high-contrast'
-            ? SGR_INIT_TRUECOLOR_HC
-            : SGR_INIT_TRUECOLOR_DARK;
-    process.stdout.write(osc + sgr);
-    if (!armed) {
-        armed = true;
-        // Belt-and-braces cleanup on every exit path. Without these, Ctrl+C leaves
-        // the user's shell stuck with our SGR state.
-        const cleanup = () => {
-            try {
-                process.stdout.write(OSC_RESET + SGR_RESET);
-            }
-            catch { }
-        };
-        process.on('exit', cleanup);
-        process.on('SIGINT', () => {
-            cleanup();
-            process.exit(130);
-        });
-        process.on('SIGTERM', () => {
-            cleanup();
-            process.exit(143);
-        });
-        process.on('SIGHUP', () => {
-            cleanup();
-            process.exit(129);
-        });
-    }
-}
-export function resetTerminalTheme() {
-    if (!supportsAnsi())
-        return;
-    if (isIcoaTerminal())
-        return; // nothing to undo
-    process.stdout.write(OSC_RESET + SGR_RESET);
-}
+const e="]110]111]112",t="";function s(){if(!process.stdout.isTTY)return!1;const e=process.stdout.getColorDepth?.();return"number"!=typeof e||e>=8}function r(){return"1"===process.env.ICOA_TERMINAL}let o=!1;export function setTerminalTheme(n="dark"){if(!s())return;if(r())return;const c="high-contrast"===n?"]10;#FFFFFF]11;#000000]12;#FFFFFF":"]10;#A9B7C6]11;#2B2B2B]12;#A9B7C6",i="Apple_Terminal"===process.env.TERM_PROGRAM?"high-contrast"===n?"":"":"high-contrast"===n?"":"";if(process.stdout.write(c+i),!o){o=!0;const s=()=>{try{process.stdout.write(e+t)}catch{}};process.on("exit",s),process.on("SIGINT",()=>{s(),process.exit(130)}),process.on("SIGTERM",()=>{s(),process.exit(143)}),process.on("SIGHUP",()=>{s(),process.exit(129)})}}export function resetTerminalTheme(){s()&&(r()||process.stdout.write(e+t))}

package/dist/lib/token-format.js

@@ -1,74 +1 @@
-/**
- * Client mirror of panda/token_alphabet.py — the confusable-free token rule.
- *
- * Tokens are <2-char prefix> + <7 random Crockford chars> + <1 checksum char>.
- * Crockford Base32 excludes I, L, O, U (look like 1, 1, 0, V) so a token copied
- * off a PDF or dictated aloud can't be mistranscribed.
- *
- * Two helpers used at token entry:
- *  - normalizeTokenBody(): fix look-alikes a human typed (O→0, I/L→1, U→V) in
- *    the BODY only (prefix is a fixed track/country code, may contain I/O).
- *  - validTokenChecksum(): verify the trailing Crockford checksum.
- *
- * IMPORTANT backward-compat note: tokens issued before 2026-06-07 used the full
- * 36-char alphabet and have NO valid checksum (and ~61% of learn tokens contain
- * a real I/L/O/U in the body). So on the LEARN path normalization must be a
- * FALLBACK (try literal first) and checksum must NEVER hard-block — the server
- * stays authoritative (BUG-001). Exam tokens have always been Crockford+checksum
- * so both helpers are safe to apply directly there.
- */
-export const CROCKFORD = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
-const CROCKFORD_SET = new Set(CROCKFORD);
-const CROCKFORD_INDEX = {};
-for (let i = 0; i < CROCKFORD.length; i++)
-    CROCKFORD_INDEX[CROCKFORD[i]] = i;
-export const PREFIX_LEN = 2;
-export const BODY_RANDOM_LEN = 7;
-export const TOKEN_LEN = PREFIX_LEN + BODY_RANDOM_LEN + 1; // 10
-// Look-alikes a human types → their Crockford canonical char.
-const CONFUSABLE_MAP = { O: '0', I: '1', L: '1', U: 'V' };
-/** Replace confusable letters in a string (uppercased first). */
-export function normalizeConfusables(s) {
-    let out = '';
-    for (const ch of s.toUpperCase())
-        out += CONFUSABLE_MAP[ch] ?? ch;
-    return out;
-}
-/**
- * Normalize a token's BODY only — the 2-char prefix is a fixed track/country
- * code (e.g. EI / IO legitimately contain I/O) and must NOT be transformed.
- * Returns the trimmed, upper-cased token with body confusables canonicalized.
- */
-export function normalizeTokenBody(token) {
-    const t = token.trim().toUpperCase();
-    if (t.length <= PREFIX_LEN)
-        return t;
-    return t.slice(0, PREFIX_LEN) + normalizeConfusables(t.slice(PREFIX_LEN));
-}
-/** 1-char Crockford mod-32 checksum over the payload chars. */
-export function checksumChar(payload) {
-    let total = 0;
-    for (const ch of payload)
-        total += CROCKFORD_INDEX[ch] ?? 0;
-    return CROCKFORD[total % 32];
-}
-/** True iff `body` is 7 Crockford chars + 1 correct checksum char. */
-export function validBody(body) {
-    if (body.length !== BODY_RANDOM_LEN + 1)
-        return false;
-    for (const ch of body)
-        if (!CROCKFORD_SET.has(ch))
-            return false;
-    return checksumChar(body.slice(0, BODY_RANDOM_LEN)) === body[BODY_RANDOM_LEN];
-}
-/**
- * Whole-token checksum check for a 10-char `<prefix><body>` token. Returns
- * false for old (pre-checksum) tokens — only meaningful as a *soft* signal on
- * the learn path; authoritative only for exam tokens.
- */
-export function validTokenChecksum(token) {
-    const t = token.trim().toUpperCase();
-    if (t.length !== TOKEN_LEN)
-        return false;
-    return validBody(t.slice(PREFIX_LEN));
-}
+export const CROCKFORD="0123456789ABCDEFGHJKMNPQRSTVWXYZ";const o=new Set(CROCKFORD),e={};for(let n=0;n<32;n++)e[CROCKFORD[n]]=n;export const PREFIX_LEN=2;export const BODY_RANDOM_LEN=7;export const TOKEN_LEN=10;const t={O:"0",I:"1",L:"1",U:"V"};export function normalizeConfusables(o){let e="";for(const n of o.toUpperCase())e+=t[n]??n;return e}export function normalizeTokenBody(o){const e=o.trim().toUpperCase();return e.length<=2?e:e.slice(0,2)+normalizeConfusables(e.slice(2))}export function checksumChar(o){let t=0;for(const n of o)t+=e[n]??0;return CROCKFORD[t%32]}export function validBody(e){if(8!==e.length)return!1;for(const t of e)if(!o.has(t))return!1;return checksumChar(e.slice(0,7))===e[7]}export function validTokenChecksum(o){const e=o.trim().toUpperCase();return 10===e.length&&validBody(e.slice(2))}