@aigne/afs-cli 1.11.0-beta.11 → 1.11.0-beta.12

package/dist/config/afs-loader.mjs

@@ -1,11 +1,28 @@
 import { __require } from "../_virtual/rolldown_runtime.mjs";
-import { ConfigLoader } from "./loader.mjs";
+import { extractEnvFromURI, mergeStoredCredentials, persistCredentialResult, resolveAndMergeCredentials, resolveCredentialsForMount } from "./credential-helpers.mjs";
+import { AFS_USER_CONFIG_DIR_ENV, CONFIG_DIR_NAME, ConfigLoader } from "./loader.mjs";
 import { persistMount, unpersistMount, updateMountOptions } from "./mount-commands.mjs";
+import { mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import { AFS, ProviderRegistry } from "@aigne/afs";
 import { parseURI } from "@aigne/afs/utils/uri";
 
 //#region src/config/afs-loader.ts
 /**
+* AFS Loader - Lazy loading with parallel tolerant mount
+*
+* Provides loadAFS() for on-demand AFS creation with caching.
+* createAFS() uses Promise.allSettled for parallel provider creation + mount,
+* tolerating individual failures while reporting them to stderr.
+*
+* Integrates 4-step credential resolution:
+* 1. Determine missing fields from provider schema
+* 2. Silent resolution (config > env > credential store)
+* 3. Interactive collection (provider auth() or default collect())
+* 4. Unified persistence (sensitive → credentials.toml, non-sensitive → config options)
+*/
+/**
 * Register the workspace:// scheme on a ProviderRegistry.
 *
 * Extracted so that both createAFS() and verifyMount() can support
@@ -27,17 +44,26 @@ function registerWorkspaceFactory(registry) {
 		});
 	});
 }
-let cached;
+const cacheMap = /* @__PURE__ */ new Map();
+function cacheKey(cwd) {
+	const { resolve: resolve$1 } = __require("node:path");
+	return resolve$1(cwd);
+}
 /**
-* Load AFS with caching - first call creates, subsequent calls return cached instance
+* Load AFS with per-cwd caching — same cwd returns same instance,
+* different cwd creates a separate instance.
 */
 async function loadAFS(cwd, options) {
+	const key = cacheKey(cwd);
+	const cached = cacheMap.get(key);
 	if (cached) return {
 		afs: cached,
-		failures: []
+		failures: [],
+		configMountPaths: [],
+		registry: new ProviderRegistry()
 	};
 	const result = await createAFS(cwd, options);
-	cached = result.afs;
+	cacheMap.set(key, result.afs);
 	return result;
 }
 /**
@@ -58,8 +84,8 @@ async function createAFS(cwd, options) {
 		const mod = await import("@aigne/afs-workspace");
 		const AFSWorkspace = mod.AFSWorkspace ?? mod.default;
 		if (!AFSWorkspace) throw new Error("workspace:// scheme requires @aigne/afs-workspace package. Install it with: pnpm add @aigne/afs-workspace");
-		const { resolve } = await import("node:path");
-		resolve(parsed.body);
+		const { resolve: resolve$1 } = await import("node:path");
+		resolve$1(parsed.body);
 		return new AFSWorkspace({
 			workspacePath: parsed.body,
 			registry,
@@ -84,6 +110,10 @@ async function createAFS(cwd, options) {
 			...mount.options
 		});
 	});
+	afs.createProviderFromMount = async (mount) => {
+		await resolveAndMergeCredentials(mount, authContext, credentialStore, registry);
+		return registry.createProvider(mount);
+	};
 	afs.loadProvider = async (uri, mountPath, options$1) => {
 		parseURI(uri);
 		const { cleanUri: loadConfigUri, envRecord: loadEnvRecord } = extractEnvFromURI(uri);
@@ -177,14 +207,14 @@ async function createAFS(cwd, options) {
 	};
 	if (config.registry?.enabled !== false) try {
 		const { AFSRegistry } = await import("@aigne/afs-registry");
-		const officialRegistry = new AFSRegistry(config.registry?.providers?.length ? { providers: config.registry.providers } : { url: "https://raw.githubusercontent.com/ArcBlock/afs-registry/refs/heads/main/providers.json" });
-		await afs.mount(officialRegistry, "/registry/official");
-		const internalRegistry = new AFSRegistry();
-		await afs.mount(internalRegistry, "/registry/internal");
+		const registry$1 = new AFSRegistry(config.registry?.providers?.length ? { providers: config.registry.providers } : void 0);
+		await afs.mount(registry$1, "/registry");
 	} catch {}
 	if (config.mounts.length === 0) return {
 		afs,
-		failures: []
+		failures: [],
+		configMountPaths: [],
+		registry
 	};
 	const total = config.mounts.length;
 	let completed = 0;
@@ -232,304 +262,23 @@ async function createAFS(cwd, options) {
 		for (const f of failures) console.warn(`  - ${f.path}: ${f.reason}`);
 	}
 	if (succeeded.length === 0 && config.mounts.length > 0) throw new Error("All providers failed to mount");
-	return {
-		afs,
-		failures
-	};
-}
-/**
-* Extract env query params from MCP URIs for secure credential storage.
-*
-* MCP servers receive secrets via env vars (e.g., `mcp+stdio://npx?env=API_KEY=sk-xxx`).
-* This function extracts env params from the URI so they can be stored in credentials.toml
-* instead of being persisted in plaintext in config.toml.
-*
-* Only applies to MCP schemes (mcp://, mcp+stdio://, mcp+sse://).
-* Non-MCP URIs are returned unchanged.
-*/
-function extractEnvFromURI(uri) {
-	const parsed = parseURI(uri);
-	const envRecord = {};
-	if (!parsed.scheme.startsWith("mcp")) return {
-		cleanUri: uri,
-		envRecord
-	};
-	const envValues = parsed.query.env;
-	if (!envValues) return {
-		cleanUri: uri,
-		envRecord
-	};
-	const envList = Array.isArray(envValues) ? envValues : [envValues];
-	for (const entry of envList) {
-		const eqIdx = entry.indexOf("=");
-		if (eqIdx > 0) envRecord[entry.slice(0, eqIdx)] = entry.slice(eqIdx + 1);
-	}
-	const queryIndex = uri.indexOf("?");
-	if (queryIndex < 0) return {
-		cleanUri: uri,
-		envRecord
-	};
-	const rawQuery = uri.slice(queryIndex + 1);
-	const params = new URLSearchParams(rawQuery);
-	params.delete("env");
-	const newQuery = params.toString();
-	const base = uri.slice(0, queryIndex);
-	return {
-		cleanUri: newQuery ? `${base}?${newQuery}` : base,
-		envRecord
-	};
-}
-/**
-* Extract template variables from mount.uri using the manifest's uriTemplate
-* and merge them into mount.options so the credential resolver sees them as "known".
-*
-* Example: cloudflare://d9e5fca3... + template "cloudflare://{accountId}"
-*        → mount.options.accountId = "d9e5fca3..."
-*/
-function mergeTemplateVarsIntoMount(mount, manifest) {
-	if (!manifest?.uriTemplate) return;
-	const { parseTemplate } = __require("@aigne/afs/utils/uri-template");
-	const parsed = parseURI(mount.uri);
-	let templateVars;
-	try {
-		templateVars = parseTemplate(manifest.uriTemplate, parsed.body);
-	} catch {
-		return;
-	}
-	for (const [key, value] of Object.entries(templateVars)) if (value !== void 0) {
-		if (!mount.options) mount.options = {};
-		if (mount.options[key] === void 0) mount.options[key] = value;
-	}
-}
-/**
-* After credential resolution, rebuild mount.uri from the template if the
-* current URI body is empty/incomplete and resolved options can fill template vars.
-*
-* Example: mount.uri = "cloudflare://" (empty body), mount.options.accountId = "abc"
-*        → mount.uri = "cloudflare://abc"
-*/
-function rebuildURIFromTemplate(mount, manifest) {
-	if (!manifest?.uriTemplate) return;
-	const { buildURI, getTemplateVariableNames } = __require("@aigne/afs/utils/uri-template");
-	const varNames = getTemplateVariableNames(manifest.uriTemplate);
-	if (varNames.length === 0) return;
-	const parsed = parseURI(mount.uri);
-	const { parseTemplate } = __require("@aigne/afs/utils/uri-template");
-	let existingVars;
-	try {
-		existingVars = parseTemplate(manifest.uriTemplate, parsed.body);
-	} catch {
-		existingVars = {};
-	}
-	const allVars = { ...existingVars };
-	for (const name of varNames) if (!allVars[name] && mount.options?.[name] != null) allVars[name] = String(mount.options[name]);
-	try {
-		const newURI = buildURI(manifest.uriTemplate, allVars);
-		if (newURI !== mount.uri) mount.uri = newURI;
-	} catch {}
-}
-/**
-* Attempt credential resolution for a mount, merging resolved values into mount.options.
-*
-* Returns the credential result if any fields were collected interactively,
-* or null if no interactive collection was needed (or no schema/authContext).
-*
-* This function mutates mount.options and mount.auth/mount.token when credentials
-* are resolved, so the subsequent registry.createProvider(mount) receives complete values.
-*/
-async function resolveAndMergeCredentials(mount, authContext, credentialStore, registry, opts) {
-	const info = await registry.getProviderInfo(mount.uri);
-	const schema = info?.schema ?? null;
-	const providerAuth = info?.auth;
-	if (!schema) return null;
-	mergeTemplateVarsIntoMount(mount, info?.manifest);
-	const { getSensitiveFields } = await import("@aigne/afs/utils/schema");
-	const sensitiveFieldsInSchema = getSensitiveFields(schema);
-	const schemaProps = schema.properties ?? {};
-	const hasEnvFields = Object.values(schemaProps).some((p) => Array.isArray(p?.env));
-	if (sensitiveFieldsInSchema.length === 0 && !hasEnvFields && !providerAuth) return null;
-	const { resolveCredentials } = await import("../credential/resolver.mjs");
-	const result = await resolveCredentials({
-		mount,
-		schema,
-		authContext,
-		credentialStore,
-		providerAuth,
-		forceCollect: opts?.forceCollect
-	});
-	if (!result) {
-		const fieldNames = Object.keys(schema.properties ?? {});
-		const known = /* @__PURE__ */ new Set();
-		if (mount.auth !== void 0) known.add("auth");
-		if (mount.token !== void 0) known.add("token");
-		if (mount.options) for (const k of Object.keys(mount.options)) known.add(k);
-		const missing = fieldNames.filter((f) => !known.has(f));
-		const fieldList = missing.length > 0 ? missing.join(", ") : fieldNames.join(", ");
-		throw new Error(`Missing credentials: ${fieldList}. Retry with them as args, e.g. { "uri": "${mount.uri}", "path": "${mount.path}", ${missing.map((f) => `"${f}": "..."`).join(", ")} }`);
-	}
-	if (Object.keys(result.values).length > 0) {
-		if (result.values.token !== void 0 && mount.token === void 0) mount.token = String(result.values.token);
-		if (result.values.auth !== void 0 && mount.auth === void 0) mount.auth = String(result.values.auth);
-		const opts$1 = mount.options ?? {};
-		for (const [key, value] of Object.entries(result.values)) if (key !== "token" && key !== "auth" && opts$1[key] === void 0) opts$1[key] = value;
-		if (Object.keys(opts$1).length > 0) mount.options = opts$1;
-	}
-	rebuildURIFromTemplate(mount, info?.manifest);
-	return result.collected ? result : null;
-}
-/**
-* Persist credential resolution result (sensitive → credentials.toml, non-sensitive → config).
-*/
-async function persistCredentialResult(mount, result) {
-	if (Object.keys(result.sensitive).length > 0) try {
-		const { createCredentialStore } = await import("../credential/store.mjs");
-		await createCredentialStore().set(mount.uri, result.sensitive);
-	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
-		console.warn(`[mount] credential persistence failed: ${msg}`);
-	}
-}
-/**
-* Load stored credentials and merge into mount options during startup.
-*
-* Credentials are keyed by URI (the resource identity), not mount path.
-*/
-async function mergeStoredCredentials(mounts, _mountSources, store) {
-	for (const mount of mounts) try {
-		const stored = await store.get(mount.uri);
-		if (stored) {
-			const opts = mount.options ?? {};
-			for (const [key, value] of Object.entries(stored)) if (key.startsWith("env:")) {
-				if (!opts.env) opts.env = {};
-				opts.env[key.slice(4)] = value;
-			} else if (opts[key] === void 0) opts[key] = value;
-			if (Object.keys(opts).length > 0) mount.options = opts;
-		}
-	} catch {}
-}
-/**
-* Resolve and persist credentials for a mount configuration.
-*
-* Used by `mount add` CLI command to trigger credential collection
-* at add-time rather than deferring to AFS creation.
-*
-* - Gets provider schema via registry
-* - Runs 4-step credential resolution
-* - Persists sensitive values to credentials.toml
-* - Returns non-sensitive values for caller to update config
-*
-* Returns null if no schema found or no credentials needed.
-* Throws if user cancels collection when credentials are required.
-*/
-async function resolveCredentialsForMount(options) {
-	const { uri, mountPath, authContext, credentialStore, extraOptions, sensitiveArgs } = options;
-	const { cleanUri: configUri, envRecord } = extractEnvFromURI(uri);
-	const hasExtractedEnv = Object.keys(envRecord).length > 0;
-	const info = await (options.registry ?? new ProviderRegistry()).getProviderInfo(uri);
-	let schema = info?.schema ?? null;
-	const providerAuth = info?.auth;
-	if (!schema && extraOptions && Object.keys(extraOptions).length > 0) {
-		const { buildAdHocSchema } = await import("@aigne/afs/utils/schema");
-		schema = buildAdHocSchema(extraOptions, sensitiveArgs ?? []);
-	}
-	const envOnlyResult = () => {
-		if (!hasExtractedEnv) return null;
-		return {
-			collected: false,
-			nonSensitive: {},
-			allValues: {},
-			persistCredentials: async () => {
-				const toStore = {};
-				for (const [key, val] of Object.entries(envRecord)) toStore[`env:${key}`] = val;
-				if (credentialStore) try {
-					await credentialStore.set(configUri, toStore);
-				} catch (err) {
-					const msg = err instanceof Error ? err.message : String(err);
-					console.warn(`[mount add] credential persistence failed: ${msg}`);
-				}
-			},
-			sensitiveFields: [],
-			configUri
-		};
-	};
-	if (!schema) return envOnlyResult();
-	const properties = schema.properties;
-	if (!properties || Object.keys(properties).length === 0) return envOnlyResult();
-	if (sensitiveArgs && sensitiveArgs.length > 0) {
-		const mergedProps = { ...properties };
-		let changed = false;
-		for (const field of sensitiveArgs) if (mergedProps[field]) {
-			mergedProps[field] = {
-				...mergedProps[field],
-				sensitive: true
-			};
-			changed = true;
-		} else if (extraOptions?.[field] !== void 0) {
-			const value = extraOptions[field];
-			mergedProps[field] = {
-				type: typeof value === "number" ? "number" : typeof value === "boolean" ? "boolean" : "string",
-				sensitive: true
-			};
-			changed = true;
-		}
-		if (changed) schema = {
-			...schema,
-			properties: mergedProps
-		};
-	}
-	const { getSensitiveFields } = await import("@aigne/afs/utils/schema");
-	const sensitiveFieldsInSchema = getSensitiveFields(schema);
-	const schemaProps = schema.properties;
-	const hasEnvFields = Object.values(schemaProps).some((p) => Array.isArray(p?.env));
-	if (sensitiveFieldsInSchema.length === 0 && !hasEnvFields && !extraOptions) return envOnlyResult();
-	const mount = {
-		uri,
-		path: mountPath
-	};
-	if (extraOptions && Object.keys(extraOptions).length > 0) mount.options = {
-		...mount.options ?? {},
-		...extraOptions
-	};
-	mergeTemplateVarsIntoMount(mount, info?.manifest);
-	const { resolveCredentials } = await import("../credential/resolver.mjs");
-	const result = await resolveCredentials({
-		mount,
-		schema,
-		authContext,
-		credentialStore,
-		providerAuth,
-		forceCollect: options.forceCollect
-	});
-	if (!result) {
-		const fieldNames = Object.keys(properties);
-		throw new Error(`Missing credentials: ${fieldNames.join(", ")}. Retry with them as args, e.g. { "uri": "${uri}", "path": "${mountPath}", ${fieldNames.map((f) => `"${f}": "..."`).join(", ")} }`);
-	}
-	const sensitiveFieldSet = new Set(sensitiveFieldsInSchema);
-	const flatSensitive = {};
-	for (const field of sensitiveFieldsInSchema) {
-		const val = result.values[field];
-		if (val === void 0) continue;
-		if (field === "env" && typeof val === "object" && val !== null) for (const [envKey, envVal] of Object.entries(val)) flatSensitive[`env:${envKey}`] = String(envVal);
-		else flatSensitive[field] = String(val);
+	{
+		const dataDir = join(process.env[AFS_USER_CONFIG_DIR_ENV] ?? join(homedir(), CONFIG_DIR_NAME), "data");
+		try {
+			await mkdir(dataDir, { recursive: true });
+			const dataProvider = await registry.createProvider({
+				uri: `fs://${dataDir}`,
+				path: "/.data",
+				access_mode: "readwrite"
+			});
+			await afs.mount(dataProvider, "/.data");
+		} catch {}
 	}
-	const nonSensitive = result.collected ? result.nonSensitive : extraOptions ? Object.fromEntries(Object.entries(extraOptions).filter(([k]) => !sensitiveFieldSet.has(k))) : {};
-	const persistCredentials = async () => {
-		const toStore = { ...flatSensitive };
-		for (const [key, val] of Object.entries(envRecord)) toStore[`env:${key}`] = val;
-		if (Object.keys(toStore).length > 0 && credentialStore) try {
-			await credentialStore.set(configUri, toStore);
-		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			console.warn(`[mount add] credential persistence failed: ${msg}`);
-		}
-	};
 	return {
-		collected: result.collected,
-		nonSensitive,
-		allValues: result.values,
-		persistCredentials,
-		sensitiveFields: sensitiveFieldsInSchema,
-		configUri: hasExtractedEnv ? configUri : void 0
+		afs,
+		failures,
+		configMountPaths: succeeded,
+		registry
 	};
 }
 /**
@@ -565,8 +314,8 @@ async function verifyMount(uri, mountPath, options) {
 		const msg = err instanceof Error ? err.message : String(err);
 		throw new Error(`Mount verification failed: could not reach provider at ${uri}. Error: ${msg}. Check your URI and credentials.`);
 	} finally {
-		if (typeof provider.close === "function") try {
-			await provider.close();
+		try {
+			await provider.close?.();
 		} catch {}
 	}
 }

package/dist/config/afs-loader.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"afs-loader.mjs","names":["options","opts","AFS"],"sources":["../../src/config/afs-loader.ts"],"sourcesContent":["/**\n * AFS Loader - Lazy loading with parallel tolerant mount\n *\n * Provides loadAFS() for on-demand AFS creation with caching.\n * createAFS() uses Promise.allSettled for parallel provider creation + mount,\n * tolerating individual failures while reporting them to stderr.\n *\n * Integrates 4-step credential resolution:\n * 1. Determine missing fields from provider schema\n * 2. Silent resolution (config > env > credential store)\n * 3. Interactive collection (provider auth() or default collect())\n * 4. Unified persistence (sensitive → credentials.toml, non-sensitive → config options)\n */\n\nimport type { AFSModule, AuthContext, MountConfig } from \"@aigne/afs\";\nimport { AFS, ProviderRegistry } from \"@aigne/afs\";\nimport { parseURI } from \"@aigne/afs/utils/uri\";\nimport type { CredentialStore } from \"../credential/store.js\";\nimport { ConfigLoader } from \"./loader.js\";\nimport {\n  type ConfigMountEntry,\n  type PersistScope,\n  persistMount,\n  unpersistMount,\n  updateMountOptions,\n} from \"./mount-commands.js\";\n\n// ─── Workspace Factory Helper ─────────────────────────────────────────────\n\n/**\n * Register the workspace:// scheme on a ProviderRegistry.\n *\n * Extracted so that both createAFS() and verifyMount() can support\n * workspace URIs. createAFS() overrides this with a richer variant\n * that includes credential resolution.\n */\nfunction registerWorkspaceFactory(registry: import(\"@aigne/afs\").ProviderRegistry): void {\n  registry.register(\"workspace\", async (mount, parsed) => {\n    const mod = await import(\"@aigne/afs-workspace\" as string);\n    const AFSWorkspace = mod.AFSWorkspace ?? mod.default;\n    if (!AFSWorkspace) {\n      throw new Error(\n        \"workspace:// scheme requires @aigne/afs-workspace package. Install it with: pnpm add @aigne/afs-workspace\",\n      );\n    }\n    return new AFSWorkspace({\n      workspacePath: parsed.body,\n      registry,\n      name: mount.path.slice(1).replace(/\\//g, \"-\") || \"workspace\",\n      description: mount.description,\n      accessMode: mount.access_mode,\n      ...mount.options,\n    });\n  });\n}\n\n// ─── Types ────────────────────────────────────────────────────────────────\n\nexport interface MountProgressEvent {\n  total: number;\n  completed: number;\n  failed: number;\n}\n\nexport interface MountFailure {\n  path: string;\n  reason: string;\n}\n\nexport interface CreateAFSResult {\n  afs: AFS;\n  failures: MountFailure[];\n}\n\nexport interface CreateAFSOptions {\n  onProgress?: (event: MountProgressEvent) => void;\n  /** Auth context for interactive credential collection (CLI or MCP) */\n  authContext?: AuthContext;\n  /** Credential store for reading/writing credentials */\n  credentialStore?: CredentialStore;\n}\n\n// ─── Cache ────────────────────────────────────────────────────────────────\n\nlet cached: AFS | undefined;\n\n/**\n * Reset the cached AFS instance (for testing)\n */\nexport function resetAFSCache(): void {\n  cached = undefined;\n}\n\n/**\n * Load AFS with caching - first call creates, subsequent calls return cached instance\n */\nexport async function loadAFS(cwd: string, options?: CreateAFSOptions): Promise<CreateAFSResult> {\n  if (cached) return { afs: cached, failures: [] };\n  const result = await createAFS(cwd, options);\n  cached = result.afs;\n  return result;\n}\n\n/**\n * Create AFS instance from config with parallel tolerant mount\n *\n * - All providers are created and mounted in parallel via Promise.allSettled\n * - Individual failures are logged to stderr and skipped (unless onProgress is provided)\n * - If ALL providers fail, throws an error\n * - If no mounts configured, returns empty AFS (no error)\n */\nexport async function createAFS(cwd: string, options?: CreateAFSOptions): Promise<CreateAFSResult> {\n  const loader = new ConfigLoader();\n  const { config, mountSources } = await loader.loadWithSources(cwd);\n  const afs = new AFS();\n  const authContext = options?.authContext;\n  const credentialStore = options?.credentialStore;\n\n  // Create registry — auto-loads built-in providers via manifest-driven resolution.\n  // Only workspace needs explicit registration (to break circular deps + inject credential callback).\n  const registry = new ProviderRegistry();\n  registry.register(\"workspace\", async (mount, parsed) => {\n    const mod = await import(\"@aigne/afs-workspace\" as string);\n    const AFSWorkspace = mod.AFSWorkspace ?? mod.default;\n    if (!AFSWorkspace) {\n      throw new Error(\n        \"workspace:// scheme requires @aigne/afs-workspace package. Install it with: pnpm add @aigne/afs-workspace\",\n      );\n    }\n    const { resolve } = await import(\"node:path\");\n    const _workspacePath = resolve(parsed.body);\n    return new AFSWorkspace({\n      workspacePath: parsed.body,\n      registry,\n      createProvider: async (subMount: MountConfig) => {\n        const credResult = await resolveAndMergeCredentials(\n          subMount,\n          authContext,\n          credentialStore,\n          registry,\n        );\n        // Create provider with resolved credentials in mount.options\n        const provider = await registry.createProvider(subMount);\n        // Persist sensitive credentials to credential store\n        if (credResult) {\n          await persistCredentialResult(subMount, credResult);\n          // Strip sensitive values from mount.options (keep only non-sensitive for config)\n          const opts = subMount.options ?? {};\n          for (const key of Object.keys(credResult.sensitive)) {\n            delete opts[key];\n          }\n          subMount.options = Object.keys(opts).length > 0 ? opts : undefined;\n          // Merge non-sensitive resolved values back\n          if (Object.keys(credResult.nonSensitive).length > 0) {\n            subMount.options = { ...(subMount.options ?? {}), ...credResult.nonSensitive };\n          }\n        }\n        return provider;\n      },\n      name: mount.path.slice(1).replace(/\\//g, \"-\") || \"workspace\",\n      description: mount.description,\n      accessMode: mount.access_mode,\n      ...mount.options,\n    });\n  });\n\n  // ── Inject loadProvider ──\n  // Allows agents to mount new providers at runtime via /.actions/mount\n  afs.loadProvider = async (uri: string, mountPath: string, options?: Record<string, unknown>) => {\n    // Validate URI format before passing to factory\n    parseURI(uri);\n\n    // Extract env query params from MCP URIs for secure credential storage\n    const { cleanUri: loadConfigUri, envRecord: loadEnvRecord } = extractEnvFromURI(uri);\n    const hasLoadEnv = Object.keys(loadEnvRecord).length > 0;\n\n    // Extract known mount-level fields; pass remaining as provider-specific options\n    const { accessMode, auth, description, scope, ...providerOptions } = options ?? {};\n\n    // Inject extracted env values into provider options\n    if (hasLoadEnv) {\n      const existingEnv = (providerOptions.env as Record<string, string>) ?? {};\n      providerOptions.env = { ...existingEnv, ...loadEnvRecord };\n    }\n\n    const mount: MountConfig = {\n      uri,\n      path: mountPath,\n      access_mode: (accessMode as \"readonly\" | \"readwrite\") ?? undefined,\n      auth: (auth as string) ?? undefined,\n      description: (description as string) ?? undefined,\n      options: Object.keys(providerOptions).length > 0 ? providerOptions : undefined,\n    };\n\n    const persistScope = (scope as PersistScope) || \"cwd\";\n    let credResult = await resolveAndMergeCredentials(\n      mount,\n      authContext,\n      credentialStore,\n      registry,\n    );\n\n    try {\n      const provider = await registry.createProvider(mount);\n      await afs.mount(provider, mountPath);\n    } catch (mountError) {\n      // Health check failed with silently resolved credentials →\n      // retry once with forced interactive collection so user can fix values\n      if (credResult === null && authContext) {\n        // credResult === null means all fields resolved silently (no interactive collection)\n        // Rebuild mount config from scratch for retry\n        const retryProviderOptions = { ...providerOptions };\n        const retryMount: MountConfig = {\n          uri,\n          path: mountPath,\n          access_mode: (accessMode as \"readonly\" | \"readwrite\") ?? undefined,\n          auth: (auth as string) ?? undefined,\n          description: (description as string) ?? undefined,\n          options: Object.keys(retryProviderOptions).length > 0 ? retryProviderOptions : undefined,\n        };\n        credResult = await resolveAndMergeCredentials(\n          retryMount,\n          authContext,\n          credentialStore,\n          registry,\n          { forceCollect: true },\n        );\n        const retryProvider = await registry.createProvider(retryMount);\n        await afs.mount(retryProvider, mountPath);\n        // Update mount reference for persistence below\n        Object.assign(mount, retryMount);\n      } else {\n        throw mountError;\n      }\n    }\n\n    // Persist credentials if any were collected\n    if (credResult) {\n      await persistCredentialResult(mount, credResult);\n    }\n\n    // Persist extracted MCP env values to credentials.toml\n    if (hasLoadEnv && credentialStore) {\n      try {\n        const envCreds: Record<string, string> = {};\n        for (const [k, v] of Object.entries(loadEnvRecord)) {\n          envCreds[`env:${k}`] = v;\n        }\n        // Merge with any existing sensitive values from credential resolution\n        const existing = credResult ? { ...credResult.sensitive } : {};\n        await credentialStore.set(loadConfigUri, { ...existing, ...envCreds });\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.warn(`[mount] env credential persistence failed: ${msg}`);\n      }\n    }\n\n    // Always persist to config after successful mount\n    try {\n      // Use configUri (env stripped) for config.toml — env values are in credentials.toml\n      const entry: ConfigMountEntry = {\n        path: mountPath,\n        uri: hasLoadEnv ? loadConfigUri : mount.uri,\n      };\n      if (description) entry.description = description as string;\n      if (accessMode) entry.access_mode = accessMode as \"readonly\" | \"readwrite\";\n      if (auth) entry.auth = auth as string;\n      const mergedOptions = { ...providerOptions, ...credResult?.nonSensitive };\n      // Strip env from config options — it's in credentials.toml\n      if (hasLoadEnv) delete mergedOptions.env;\n      if (Object.keys(mergedOptions).length > 0) entry.options = mergedOptions;\n      await persistMount(cwd, entry, persistScope);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[mount] config persistence failed: ${msg}`);\n    }\n  };\n\n  // ── Inject unloadProvider ──\n  // Removes mount config when provider is unmounted via /.actions/unmount\n  afs.unloadProvider = async (mountPath: string, options?: Record<string, unknown>) => {\n    try {\n      await unpersistMount(cwd, mountPath, (options?.scope as PersistScope) || undefined);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[unmount] config removal failed: ${msg}`);\n    }\n  };\n\n  // ── Inject updateProviderConfig ──\n  // Allows providers to persist option changes back to their config file\n  afs.updateProviderConfig = async (mountPath: string, optionUpdates: Record<string, unknown>) => {\n    try {\n      const key = `:${mountPath}`;\n      const configDir = mountSources.get(key);\n      if (!configDir) return;\n      await updateMountOptions(configDir, mountPath, optionUpdates);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[updateProviderConfig] failed: ${msg}`);\n    }\n  };\n\n  // ── Auto-mount Registry Providers (tolerant — silent on failure) ──\n  if (config.registry?.enabled !== false) {\n    try {\n      const { AFSRegistry } = await import(\"@aigne/afs-registry\");\n\n      // /registry/official — external providers from remote registry\n      const officialRegistry = new AFSRegistry(\n        config.registry?.providers?.length\n          ? { providers: config.registry.providers as any[] }\n          : {\n              url: \"https://raw.githubusercontent.com/ArcBlock/afs-registry/refs/heads/main/providers.json\",\n            },\n      );\n      await afs.mount(officialRegistry, \"/registry/official\");\n\n      // /registry/internal — built-in providers bundled with CLI\n      const internalRegistry = new AFSRegistry();\n      await afs.mount(internalRegistry, \"/registry/internal\");\n    } catch {\n      // Silent degradation — registry is optional\n    }\n  }\n\n  if (config.mounts.length === 0) {\n    return { afs, failures: [] };\n  }\n\n  const total = config.mounts.length;\n  let completed = 0;\n  let failedCount = 0;\n\n  options?.onProgress?.({ total, completed: 0, failed: 0 });\n\n  // Load stored credentials keyed by URI\n  if (credentialStore && mountSources.size > 0) {\n    await mergeStoredCredentials(config.mounts, mountSources, credentialStore);\n  }\n\n  const results = await Promise.allSettled(\n    config.mounts.map(async (mount) => {\n      const provider = await registry.createProvider(mount);\n      await afs.mount(provider, mount.path, { namespace: mount.namespace ?? null });\n      completed++;\n      options?.onProgress?.({ total, completed, failed: failedCount });\n      return mount.path;\n    }),\n  );\n\n  const failures: MountFailure[] = [];\n  const succeeded: string[] = [];\n\n  for (let i = 0; i < results.length; i++) {\n    const result = results[i]!;\n    if (result.status === \"fulfilled\") {\n      succeeded.push(result.value);\n    } else {\n      const reason = result.reason;\n      const msg = reason instanceof Error ? reason.message : String(reason);\n      failures.push({ path: config.mounts[i]!.path, reason: msg });\n      failedCount++;\n      completed++;\n      options?.onProgress?.({ total, completed, failed: failedCount });\n    }\n  }\n\n  // When onProgress is provided, the caller handles display; otherwise log to stderr\n  if (!options?.onProgress && failures.length > 0) {\n    console.warn(`[mount] ${succeeded.length} succeeded, ${failures.length} failed:`);\n    for (const f of failures) {\n      console.warn(`  - ${f.path}: ${f.reason}`);\n    }\n  }\n\n  if (succeeded.length === 0 && config.mounts.length > 0) {\n    throw new Error(\"All providers failed to mount\");\n  }\n\n  return { afs, failures };\n}\n\n// ─── Credential Resolution Helpers ─────────────────────────────────────────\n\n/**\n * Extract env query params from MCP URIs for secure credential storage.\n *\n * MCP servers receive secrets via env vars (e.g., `mcp+stdio://npx?env=API_KEY=sk-xxx`).\n * This function extracts env params from the URI so they can be stored in credentials.toml\n * instead of being persisted in plaintext in config.toml.\n *\n * Only applies to MCP schemes (mcp://, mcp+stdio://, mcp+sse://).\n * Non-MCP URIs are returned unchanged.\n */\nexport function extractEnvFromURI(uri: string): {\n  cleanUri: string;\n  envRecord: Record<string, string>;\n} {\n  const parsed = parseURI(uri);\n  const envRecord: Record<string, string> = {};\n\n  // Only extract env for MCP schemes\n  if (!parsed.scheme.startsWith(\"mcp\")) {\n    return { cleanUri: uri, envRecord };\n  }\n\n  const envValues = parsed.query.env;\n  if (!envValues) return { cleanUri: uri, envRecord };\n\n  // Parse env=KEY=VALUE format (split on first = only)\n  const envList = Array.isArray(envValues) ? envValues : [envValues];\n  for (const entry of envList) {\n    const eqIdx = entry.indexOf(\"=\");\n    if (eqIdx > 0) {\n      envRecord[entry.slice(0, eqIdx)] = entry.slice(eqIdx + 1);\n    }\n  }\n\n  // Rebuild URI without env params, preserving other query params\n  const queryIndex = uri.indexOf(\"?\");\n  if (queryIndex < 0) return { cleanUri: uri, envRecord };\n\n  const rawQuery = uri.slice(queryIndex + 1);\n  const params = new URLSearchParams(rawQuery);\n  params.delete(\"env\");\n  const newQuery = params.toString();\n  const base = uri.slice(0, queryIndex);\n  const cleanUri = newQuery ? `${base}?${newQuery}` : base;\n\n  return { cleanUri, envRecord };\n}\n\n/**\n * Extract template variables from mount.uri using the manifest's uriTemplate\n * and merge them into mount.options so the credential resolver sees them as \"known\".\n *\n * Example: cloudflare://d9e5fca3... + template \"cloudflare://{accountId}\"\n *        → mount.options.accountId = \"d9e5fca3...\"\n */\nfunction mergeTemplateVarsIntoMount(\n  mount: MountConfig,\n  manifest: import(\"@aigne/afs\").ProviderManifest | null | undefined,\n): void {\n  if (!manifest?.uriTemplate) return;\n  const { parseTemplate } =\n    require(\"@aigne/afs/utils/uri-template\") as typeof import(\"@aigne/afs/utils/uri-template\");\n  const parsed = parseURI(mount.uri);\n  // Gracefully handle empty/partial URI bodies — template vars may not be\n  // extractable yet (e.g. when the mount action was called without --uri and\n  // without providing all required template parameters as args).\n  let templateVars: Record<string, string | undefined>;\n  try {\n    templateVars = parseTemplate(manifest.uriTemplate, parsed.body);\n  } catch {\n    return; // Body doesn't match template yet — nothing to merge\n  }\n  for (const [key, value] of Object.entries(templateVars)) {\n    if (value !== undefined) {\n      if (!mount.options) mount.options = {};\n      if (mount.options[key] === undefined) {\n        mount.options[key] = value;\n      }\n    }\n  }\n}\n\n/**\n * After credential resolution, rebuild mount.uri from the template if the\n * current URI body is empty/incomplete and resolved options can fill template vars.\n *\n * Example: mount.uri = \"cloudflare://\" (empty body), mount.options.accountId = \"abc\"\n *        → mount.uri = \"cloudflare://abc\"\n */\nfunction rebuildURIFromTemplate(\n  mount: MountConfig,\n  manifest: import(\"@aigne/afs\").ProviderManifest | null | undefined,\n): void {\n  if (!manifest?.uriTemplate) return;\n  const { buildURI, getTemplateVariableNames } =\n    require(\"@aigne/afs/utils/uri-template\") as typeof import(\"@aigne/afs/utils/uri-template\");\n  const varNames = getTemplateVariableNames(manifest.uriTemplate);\n  if (varNames.length === 0) return;\n\n  // Check if any template vars are missing from the current URI body\n  const parsed = parseURI(mount.uri);\n  const { parseTemplate } =\n    require(\"@aigne/afs/utils/uri-template\") as typeof import(\"@aigne/afs/utils/uri-template\");\n  let existingVars: Record<string, string | undefined>;\n  try {\n    existingVars = parseTemplate(manifest.uriTemplate, parsed.body);\n  } catch {\n    existingVars = {}; // Body incomplete\n  }\n\n  // Merge: existing URI vars + mount.options (options fill in gaps)\n  const allVars: Record<string, string | undefined> = { ...existingVars };\n  for (const name of varNames) {\n    if (!allVars[name] && mount.options?.[name] != null) {\n      allVars[name] = String(mount.options[name]);\n    }\n  }\n\n  // Rebuild if we can fill more vars than the current URI has\n  try {\n    const newURI = buildURI(manifest.uriTemplate, allVars);\n    if (newURI !== mount.uri) {\n      mount.uri = newURI;\n    }\n  } catch {\n    // Still can't build a complete URI — that's OK, createProvider will handle it\n  }\n}\n\n/**\n * Attempt credential resolution for a mount, merging resolved values into mount.options.\n *\n * Returns the credential result if any fields were collected interactively,\n * or null if no interactive collection was needed (or no schema/authContext).\n *\n * This function mutates mount.options and mount.auth/mount.token when credentials\n * are resolved, so the subsequent registry.createProvider(mount) receives complete values.\n */\nasync function resolveAndMergeCredentials(\n  mount: MountConfig,\n  authContext: AuthContext | undefined,\n  credentialStore: CredentialStore | undefined,\n  registry: ProviderRegistry,\n  opts?: { forceCollect?: boolean },\n): Promise<import(\"../credential/resolver.js\").ResolveCredentialsResult | null> {\n  // Get provider schema and auth method via registry\n  const info = await registry.getProviderInfo(mount.uri);\n  const schema = info?.schema ?? null;\n  const providerAuth = info?.auth;\n\n  if (!schema) return null;\n\n  // Extract template variables from URI and merge into mount.options\n  // so they appear as \"known\" values in the resolver (skipped in form)\n  mergeTemplateVarsIntoMount(mount, info?.manifest);\n\n  // Skip interactive credential resolution when schema has no sensitive or env-annotated\n  // fields. Non-sensitive fields (like command for MCP, localPath for FS) are URI/config\n  // parameters, not credentials — they should not trigger a browser form.\n  const { getSensitiveFields } = await import(\"@aigne/afs/utils/schema\");\n  const sensitiveFieldsInSchema = getSensitiveFields(schema);\n  const schemaProps = (schema as any).properties ?? {};\n  const hasEnvFields = Object.values(schemaProps).some((p: any) => Array.isArray(p?.env));\n  if (sensitiveFieldsInSchema.length === 0 && !hasEnvFields && !providerAuth) return null;\n\n  const { resolveCredentials } = await import(\"../credential/resolver.js\");\n\n  const result = await resolveCredentials({\n    mount,\n    schema,\n    authContext,\n    credentialStore,\n    providerAuth,\n    forceCollect: opts?.forceCollect,\n  });\n\n  if (!result) {\n    // User declined/cancelled credential collection — abort mount\n    const fieldNames = Object.keys((schema as any).properties ?? {});\n    const known = new Set<string>();\n    if (mount.auth !== undefined) known.add(\"auth\");\n    if (mount.token !== undefined) known.add(\"token\");\n    if (mount.options) {\n      for (const k of Object.keys(mount.options)) known.add(k);\n    }\n    const missing = fieldNames.filter((f) => !known.has(f));\n    const fieldList = missing.length > 0 ? missing.join(\", \") : fieldNames.join(\", \");\n    throw new Error(\n      `Missing credentials: ${fieldList}. ` +\n        `Retry with them as args, e.g. { \"uri\": \"${mount.uri}\", \"path\": \"${mount.path}\", ${missing.map((f) => `\"${f}\": \"...\"`).join(\", \")} }`,\n    );\n  }\n\n  // Merge resolved values into mount config for provider creation\n  if (Object.keys(result.values).length > 0) {\n    // Map sensitive credential fields to mount.auth/token if applicable\n    if (result.values.token !== undefined && mount.token === undefined) {\n      mount.token = String(result.values.token);\n    }\n    if (result.values.auth !== undefined && mount.auth === undefined) {\n      mount.auth = String(result.values.auth);\n    }\n\n    // Merge remaining resolved values into mount.options\n    const opts = mount.options ?? {};\n    for (const [key, value] of Object.entries(result.values)) {\n      if (key !== \"token\" && key !== \"auth\" && opts[key] === undefined) {\n        opts[key] = value;\n      }\n    }\n    if (Object.keys(opts).length > 0) {\n      mount.options = opts;\n    }\n  }\n\n  // Rebuild URI if credential resolution filled in template variables\n  // (e.g. accountId collected via form → cloudflare:// becomes cloudflare://abc)\n  rebuildURIFromTemplate(mount, info?.manifest);\n\n  return result.collected ? result : null;\n}\n\n/**\n * Persist credential resolution result (sensitive → credentials.toml, non-sensitive → config).\n */\nasync function persistCredentialResult(\n  mount: MountConfig,\n  result: import(\"../credential/resolver.js\").ResolveCredentialsResult,\n): Promise<void> {\n  if (Object.keys(result.sensitive).length > 0) {\n    try {\n      const { createCredentialStore } = await import(\"../credential/store.js\");\n      const store = createCredentialStore();\n      await store.set(mount.uri, result.sensitive);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[mount] credential persistence failed: ${msg}`);\n    }\n  }\n}\n\n/**\n * Load stored credentials and merge into mount options during startup.\n *\n * Credentials are keyed by URI (the resource identity), not mount path.\n */\nasync function mergeStoredCredentials(\n  mounts: MountConfig[],\n  _mountSources: Map<string, string>,\n  store: CredentialStore,\n): Promise<void> {\n  for (const mount of mounts) {\n    try {\n      const stored = await store.get(mount.uri);\n      if (stored) {\n        const opts = mount.options ?? {};\n        for (const [key, value] of Object.entries(stored)) {\n          if (key.startsWith(\"env:\")) {\n            // Reconstruct env Record from flattened env:KEY credential entries\n            if (!opts.env) opts.env = {};\n            (opts.env as Record<string, string>)[key.slice(4)] = value;\n          } else if (opts[key] === undefined) {\n            opts[key] = value;\n          }\n        }\n        if (Object.keys(opts).length > 0) {\n          mount.options = opts;\n        }\n      }\n    } catch {\n      // Credential lookup failure is non-fatal\n    }\n  }\n}\n\n// ─── Exported Credential Resolution for CLI mount add ───────────────────────\n\nexport interface ResolveCredentialsForMountOptions {\n  cwd: string;\n  uri: string;\n  mountPath: string;\n  authContext?: AuthContext;\n  credentialStore?: CredentialStore;\n  /** Extra key-value options provided by the user (e.g., --host, --password) */\n  extraOptions?: Record<string, unknown>;\n  /** Field names that should be treated as sensitive (for ad-hoc schema) */\n  sensitiveArgs?: string[];\n  /** Registry instance for resolving provider schema/auth. If not provided, one is created. */\n  registry?: ProviderRegistry;\n  /** Force interactive collection even when all fields are silently resolved.\n   *  Used for retry after health-check failure with stale env/store values. */\n  forceCollect?: boolean;\n}\n\nexport interface ResolveCredentialsForMountResult {\n  /** Whether interactive collection was performed */\n  collected: boolean;\n  /** Non-sensitive values to persist in config.toml options */\n  nonSensitive: Record<string, unknown>;\n  /** All resolved values (for mount verification before persisting) */\n  allValues: Record<string, unknown>;\n  /** Persist sensitive credentials to credentials.toml.\n   *  Call AFTER health check succeeds — never before. */\n  persistCredentials: () => Promise<void>;\n  /** Sensitive field names — caller should strip these from config options */\n  sensitiveFields: string[];\n  /** URI with env params stripped (for MCP URIs). Use for config.toml persistence.\n   *  Undefined when no env extraction was performed. */\n  configUri?: string;\n}\n\n/**\n * Resolve and persist credentials for a mount configuration.\n *\n * Used by `mount add` CLI command to trigger credential collection\n * at add-time rather than deferring to AFS creation.\n *\n * - Gets provider schema via registry\n * - Runs 4-step credential resolution\n * - Persists sensitive values to credentials.toml\n * - Returns non-sensitive values for caller to update config\n *\n * Returns null if no schema found or no credentials needed.\n * Throws if user cancels collection when credentials are required.\n */\nexport async function resolveCredentialsForMount(\n  options: ResolveCredentialsForMountOptions,\n): Promise<ResolveCredentialsForMountResult | null> {\n  const { uri, mountPath, authContext, credentialStore, extraOptions, sensitiveArgs } = options;\n\n  // Extract env query params from MCP URIs for secure credential storage\n  const { cleanUri: configUri, envRecord } = extractEnvFromURI(uri);\n  const hasExtractedEnv = Object.keys(envRecord).length > 0;\n\n  // Get provider schema and auth via registry\n  const registry = options.registry ?? new ProviderRegistry();\n  const info = await registry.getProviderInfo(uri);\n  let schema = info?.schema ?? null;\n  const providerAuth = info?.auth;\n\n  // Fallback: build ad-hoc schema from extraOptions + sensitiveArgs\n  if (!schema && extraOptions && Object.keys(extraOptions).length > 0) {\n    const { buildAdHocSchema } = await import(\"@aigne/afs/utils/schema\");\n    schema = buildAdHocSchema(extraOptions, sensitiveArgs ?? []);\n  }\n  // Helper: return env-only result when no schema-based credential resolution is needed\n  // but env values were extracted from MCP URI and need credential storage\n  const envOnlyResult = (): ResolveCredentialsForMountResult | null => {\n    if (!hasExtractedEnv) return null;\n    return {\n      collected: false,\n      nonSensitive: {},\n      allValues: {},\n      persistCredentials: async () => {\n        const toStore: Record<string, string> = {};\n        for (const [key, val] of Object.entries(envRecord)) {\n          toStore[`env:${key}`] = val;\n        }\n        if (credentialStore) {\n          try {\n            await credentialStore.set(configUri, toStore);\n          } catch (err) {\n            const msg = err instanceof Error ? err.message : String(err);\n            console.warn(`[mount add] credential persistence failed: ${msg}`);\n          }\n        }\n      },\n      sensitiveFields: [],\n      configUri,\n    };\n  };\n\n  if (!schema) return envOnlyResult();\n\n  const properties = (schema as any).properties;\n  if (!properties || Object.keys(properties).length === 0) return envOnlyResult();\n\n  // Augment schema with sensitiveArgs — mark existing fields as sensitive\n  // and add new fields not in provider schema (from extraOptions)\n  if (sensitiveArgs && sensitiveArgs.length > 0) {\n    const mergedProps = { ...properties };\n    let changed = false;\n    for (const field of sensitiveArgs) {\n      if (mergedProps[field]) {\n        // Existing field → mark as sensitive\n        mergedProps[field] = { ...mergedProps[field], sensitive: true };\n        changed = true;\n      } else if (extraOptions?.[field] !== undefined) {\n        // New field not in provider schema → add with inferred type\n        const value = extraOptions[field];\n        mergedProps[field] = {\n          type:\n            typeof value === \"number\"\n              ? \"number\"\n              : typeof value === \"boolean\"\n                ? \"boolean\"\n                : \"string\",\n          sensitive: true,\n        };\n        changed = true;\n      }\n    }\n    if (changed) {\n      schema = { ...schema, properties: mergedProps } as typeof schema;\n    }\n  }\n\n  // Skip credential resolution if no fields need credential handling.\n  // A field needs credential handling if it has `sensitive: true` (needs secure storage)\n  // or `env` metadata (can be resolved from environment variables).\n  // Plain required fields (like localPath for fs://) are URI parameters, not credentials.\n  const { getSensitiveFields } = await import(\"@aigne/afs/utils/schema\");\n  const sensitiveFieldsInSchema = getSensitiveFields(schema);\n  const schemaProps = (schema as any).properties;\n  const hasEnvFields = Object.values(schemaProps).some((p: any) => Array.isArray(p?.env));\n  if (sensitiveFieldsInSchema.length === 0 && !hasEnvFields && !extraOptions)\n    return envOnlyResult();\n\n  // Build mount config for resolver\n  const mount: MountConfig = { uri, path: mountPath };\n\n  // Merge extraOptions into mount.options so resolver sees them as known values\n  if (extraOptions && Object.keys(extraOptions).length > 0) {\n    mount.options = { ...(mount.options ?? {}), ...extraOptions };\n  }\n\n  // Extract template variables from URI and merge into mount.options\n  mergeTemplateVarsIntoMount(mount, info?.manifest);\n\n  // Resolve credentials — schema comes from manifest (user-facing fields only)\n  const { resolveCredentials } = await import(\"../credential/resolver.js\");\n\n  const result = await resolveCredentials({\n    mount,\n    schema,\n    authContext,\n    credentialStore,\n    providerAuth,\n    forceCollect: options.forceCollect,\n  });\n\n  if (!result) {\n    // User declined — include field names for actionable error\n    const fieldNames = Object.keys(properties);\n    throw new Error(\n      `Missing credentials: ${fieldNames.join(\", \")}. ` +\n        `Retry with them as args, e.g. { \"uri\": \"${uri}\", \"path\": \"${mountPath}\", ${fieldNames.map((f) => `\"${f}\": \"...\"`).join(\", \")} }`,\n    );\n  }\n\n  // Compute sensitive fields from (possibly augmented) schema\n  const sensitiveFieldSet = new Set(sensitiveFieldsInSchema);\n\n  // Build flattened sensitive values for credential store.\n  // Handles env object → env:KEY flattening for flat credential storage.\n  const flatSensitive: Record<string, string> = {};\n  for (const field of sensitiveFieldsInSchema) {\n    const val = result.values[field];\n    if (val === undefined) continue;\n    if (field === \"env\" && typeof val === \"object\" && val !== null) {\n      for (const [envKey, envVal] of Object.entries(val as Record<string, string>)) {\n        flatSensitive[`env:${envKey}`] = String(envVal);\n      }\n    } else {\n      flatSensitive[field] = String(val);\n    }\n  }\n\n  // Non-sensitive values for config.toml options\n  const nonSensitive: Record<string, unknown> = result.collected\n    ? result.nonSensitive\n    : extraOptions\n      ? Object.fromEntries(Object.entries(extraOptions).filter(([k]) => !sensitiveFieldSet.has(k)))\n      : {};\n\n  // Build deferred persistence callback — caller invokes AFTER health check succeeds\n  // Merges schema-sensitive values with extracted env values from MCP URIs\n  const persistCredentials = async () => {\n    const toStore = { ...flatSensitive };\n    // Merge env values extracted from MCP URI (env:KEY format)\n    for (const [key, val] of Object.entries(envRecord)) {\n      toStore[`env:${key}`] = val;\n    }\n    if (Object.keys(toStore).length > 0 && credentialStore) {\n      try {\n        // Use configUri (env stripped) as credential key so reload can match\n        await credentialStore.set(configUri, toStore);\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.warn(`[mount add] credential persistence failed: ${msg}`);\n      }\n    }\n  };\n\n  return {\n    collected: result.collected,\n    nonSensitive,\n    allValues: result.values,\n    persistCredentials,\n    sensitiveFields: sensitiveFieldsInSchema,\n    configUri: hasExtractedEnv ? configUri : undefined,\n  };\n}\n\n// ─── Mount Verification ───────────────────────────────────────────────────────\n\n/**\n * Verify that a mount configuration produces a working provider.\n *\n * Creates the provider and mounts it on a temporary AFS instance,\n * which triggers the built-in checkProviderOnMount (stat + data validation + list).\n * Throws if the mount check fails.\n *\n * @param uri - Provider URI\n * @param mountPath - Mount path\n * @param options - Merged options (non-sensitive + sensitive) for provider creation\n */\nexport async function verifyMount(\n  uri: string,\n  mountPath: string,\n  options?: Record<string, unknown>,\n): Promise<void> {\n  const mount: MountConfig = {\n    uri,\n    path: mountPath,\n    options: options && Object.keys(options).length > 0 ? options : undefined,\n  };\n\n  const registry = new ProviderRegistry();\n  registerWorkspaceFactory(registry);\n  let provider: AFSModule;\n  try {\n    provider = await registry.createProvider(mount);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`Mount verification failed (provider creation): ${msg}`);\n  }\n\n  // Mount on a temporary AFS to trigger the real checkProviderOnMount\n  try {\n    const { AFS } = await import(\"@aigne/afs\");\n    const tempAFS = new AFS();\n    await tempAFS.mount(provider, mountPath);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(\n      `Mount verification failed: could not reach provider at ${uri}. ` +\n        `Error: ${msg}. Check your URI and credentials.`,\n    );\n  } finally {\n    // Clean up provider resources (e.g., MCP process)\n    if (typeof (provider as any).close === \"function\") {\n      try {\n        await (provider as any).close();\n      } catch {\n        // ignore cleanup errors\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAoCA,SAAS,yBAAyB,UAAuD;AACvF,UAAS,SAAS,aAAa,OAAO,OAAO,WAAW;EACtD,MAAM,MAAM,MAAM,OAAO;EACzB,MAAM,eAAe,IAAI,gBAAgB,IAAI;AAC7C,MAAI,CAAC,aACH,OAAM,IAAI,MACR,4GACD;AAEH,SAAO,IAAI,aAAa;GACtB,eAAe,OAAO;GACtB;GACA,MAAM,MAAM,KAAK,MAAM,EAAE,CAAC,QAAQ,OAAO,IAAI,IAAI;GACjD,aAAa,MAAM;GACnB,YAAY,MAAM;GAClB,GAAG,MAAM;GACV,CAAC;GACF;;AA+BJ,IAAI;;;;AAYJ,eAAsB,QAAQ,KAAa,SAAsD;AAC/F,KAAI,OAAQ,QAAO;EAAE,KAAK;EAAQ,UAAU,EAAE;EAAE;CAChD,MAAM,SAAS,MAAM,UAAU,KAAK,QAAQ;AAC5C,UAAS,OAAO;AAChB,QAAO;;;;;;;;;;AAWT,eAAsB,UAAU,KAAa,SAAsD;CAEjG,MAAM,EAAE,QAAQ,iBAAiB,MADlB,IAAI,cAAc,CACa,gBAAgB,IAAI;CAClE,MAAM,MAAM,IAAI,KAAK;CACrB,MAAM,cAAc,SAAS;CAC7B,MAAM,kBAAkB,SAAS;CAIjC,MAAM,WAAW,IAAI,kBAAkB;AACvC,UAAS,SAAS,aAAa,OAAO,OAAO,WAAW;EACtD,MAAM,MAAM,MAAM,OAAO;EACzB,MAAM,eAAe,IAAI,gBAAgB,IAAI;AAC7C,MAAI,CAAC,aACH,OAAM,IAAI,MACR,4GACD;EAEH,MAAM,EAAE,YAAY,MAAM,OAAO;AACV,UAAQ,OAAO,KAAK;AAC3C,SAAO,IAAI,aAAa;GACtB,eAAe,OAAO;GACtB;GACA,gBAAgB,OAAO,aAA0B;IAC/C,MAAM,aAAa,MAAM,2BACvB,UACA,aACA,iBACA,SACD;IAED,MAAM,WAAW,MAAM,SAAS,eAAe,SAAS;AAExD,QAAI,YAAY;AACd,WAAM,wBAAwB,UAAU,WAAW;KAEnD,MAAM,OAAO,SAAS,WAAW,EAAE;AACnC,UAAK,MAAM,OAAO,OAAO,KAAK,WAAW,UAAU,CACjD,QAAO,KAAK;AAEd,cAAS,UAAU,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO;AAEzD,SAAI,OAAO,KAAK,WAAW,aAAa,CAAC,SAAS,EAChD,UAAS,UAAU;MAAE,GAAI,SAAS,WAAW,EAAE;MAAG,GAAG,WAAW;MAAc;;AAGlF,WAAO;;GAET,MAAM,MAAM,KAAK,MAAM,EAAE,CAAC,QAAQ,OAAO,IAAI,IAAI;GACjD,aAAa,MAAM;GACnB,YAAY,MAAM;GAClB,GAAG,MAAM;GACV,CAAC;GACF;AAIF,KAAI,eAAe,OAAO,KAAa,WAAmB,cAAsC;AAE9F,WAAS,IAAI;EAGb,MAAM,EAAE,UAAU,eAAe,WAAW,kBAAkB,kBAAkB,IAAI;EACpF,MAAM,aAAa,OAAO,KAAK,cAAc,CAAC,SAAS;EAGvD,MAAM,EAAE,YAAY,MAAM,aAAa,OAAO,GAAG,oBAAoBA,aAAW,EAAE;AAGlF,MAAI,WAEF,iBAAgB,MAAM;GAAE,GADH,gBAAgB,OAAkC,EAAE;GACjC,GAAG;GAAe;EAG5D,MAAM,QAAqB;GACzB;GACA,MAAM;GACN,aAAc,cAA2C;GACzD,MAAO,QAAmB;GAC1B,aAAc,eAA0B;GACxC,SAAS,OAAO,KAAK,gBAAgB,CAAC,SAAS,IAAI,kBAAkB;GACtE;EAED,MAAM,eAAgB,SAA0B;EAChD,IAAI,aAAa,MAAM,2BACrB,OACA,aACA,iBACA,SACD;AAED,MAAI;GACF,MAAM,WAAW,MAAM,SAAS,eAAe,MAAM;AACrD,SAAM,IAAI,MAAM,UAAU,UAAU;WAC7B,YAAY;AAGnB,OAAI,eAAe,QAAQ,aAAa;IAGtC,MAAM,uBAAuB,EAAE,GAAG,iBAAiB;IACnD,MAAM,aAA0B;KAC9B;KACA,MAAM;KACN,aAAc,cAA2C;KACzD,MAAO,QAAmB;KAC1B,aAAc,eAA0B;KACxC,SAAS,OAAO,KAAK,qBAAqB,CAAC,SAAS,IAAI,uBAAuB;KAChF;AACD,iBAAa,MAAM,2BACjB,YACA,aACA,iBACA,UACA,EAAE,cAAc,MAAM,CACvB;IACD,MAAM,gBAAgB,MAAM,SAAS,eAAe,WAAW;AAC/D,UAAM,IAAI,MAAM,eAAe,UAAU;AAEzC,WAAO,OAAO,OAAO,WAAW;SAEhC,OAAM;;AAKV,MAAI,WACF,OAAM,wBAAwB,OAAO,WAAW;AAIlD,MAAI,cAAc,gBAChB,KAAI;GACF,MAAM,WAAmC,EAAE;AAC3C,QAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,cAAc,CAChD,UAAS,OAAO,OAAO;GAGzB,MAAM,WAAW,aAAa,EAAE,GAAG,WAAW,WAAW,GAAG,EAAE;AAC9D,SAAM,gBAAgB,IAAI,eAAe;IAAE,GAAG;IAAU,GAAG;IAAU,CAAC;WAC/D,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,8CAA8C,MAAM;;AAKrE,MAAI;GAEF,MAAM,QAA0B;IAC9B,MAAM;IACN,KAAK,aAAa,gBAAgB,MAAM;IACzC;AACD,OAAI,YAAa,OAAM,cAAc;AACrC,OAAI,WAAY,OAAM,cAAc;AACpC,OAAI,KAAM,OAAM,OAAO;GACvB,MAAM,gBAAgB;IAAE,GAAG;IAAiB,GAAG,YAAY;IAAc;AAEzE,OAAI,WAAY,QAAO,cAAc;AACrC,OAAI,OAAO,KAAK,cAAc,CAAC,SAAS,EAAG,OAAM,UAAU;AAC3D,SAAM,aAAa,KAAK,OAAO,aAAa;WACrC,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,sCAAsC,MAAM;;;AAM7D,KAAI,iBAAiB,OAAO,WAAmB,cAAsC;AACnF,MAAI;AACF,SAAM,eAAe,KAAK,WAAYA,WAAS,SAA0B,OAAU;WAC5E,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,oCAAoC,MAAM;;;AAM3D,KAAI,uBAAuB,OAAO,WAAmB,kBAA2C;AAC9F,MAAI;GACF,MAAM,MAAM,IAAI;GAChB,MAAM,YAAY,aAAa,IAAI,IAAI;AACvC,OAAI,CAAC,UAAW;AAChB,SAAM,mBAAmB,WAAW,WAAW,cAAc;WACtD,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,kCAAkC,MAAM;;;AAKzD,KAAI,OAAO,UAAU,YAAY,MAC/B,KAAI;EACF,MAAM,EAAE,gBAAgB,MAAM,OAAO;EAGrC,MAAM,mBAAmB,IAAI,YAC3B,OAAO,UAAU,WAAW,SACxB,EAAE,WAAW,OAAO,SAAS,WAAoB,GACjD,EACE,KAAK,0FACN,CACN;AACD,QAAM,IAAI,MAAM,kBAAkB,qBAAqB;EAGvD,MAAM,mBAAmB,IAAI,aAAa;AAC1C,QAAM,IAAI,MAAM,kBAAkB,qBAAqB;SACjD;AAKV,KAAI,OAAO,OAAO,WAAW,EAC3B,QAAO;EAAE;EAAK,UAAU,EAAE;EAAE;CAG9B,MAAM,QAAQ,OAAO,OAAO;CAC5B,IAAI,YAAY;CAChB,IAAI,cAAc;AAElB,UAAS,aAAa;EAAE;EAAO,WAAW;EAAG,QAAQ;EAAG,CAAC;AAGzD,KAAI,mBAAmB,aAAa,OAAO,EACzC,OAAM,uBAAuB,OAAO,QAAQ,cAAc,gBAAgB;CAG5E,MAAM,UAAU,MAAM,QAAQ,WAC5B,OAAO,OAAO,IAAI,OAAO,UAAU;EACjC,MAAM,WAAW,MAAM,SAAS,eAAe,MAAM;AACrD,QAAM,IAAI,MAAM,UAAU,MAAM,MAAM,EAAE,WAAW,MAAM,aAAa,MAAM,CAAC;AAC7E;AACA,WAAS,aAAa;GAAE;GAAO;GAAW,QAAQ;GAAa,CAAC;AAChE,SAAO,MAAM;GACb,CACH;CAED,MAAM,WAA2B,EAAE;CACnC,MAAM,YAAsB,EAAE;AAE9B,MAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;EACvC,MAAM,SAAS,QAAQ;AACvB,MAAI,OAAO,WAAW,YACpB,WAAU,KAAK,OAAO,MAAM;OACvB;GACL,MAAM,SAAS,OAAO;GACtB,MAAM,MAAM,kBAAkB,QAAQ,OAAO,UAAU,OAAO,OAAO;AACrE,YAAS,KAAK;IAAE,MAAM,OAAO,OAAO,GAAI;IAAM,QAAQ;IAAK,CAAC;AAC5D;AACA;AACA,YAAS,aAAa;IAAE;IAAO;IAAW,QAAQ;IAAa,CAAC;;;AAKpE,KAAI,CAAC,SAAS,cAAc,SAAS,SAAS,GAAG;AAC/C,UAAQ,KAAK,WAAW,UAAU,OAAO,cAAc,SAAS,OAAO,UAAU;AACjF,OAAK,MAAM,KAAK,SACd,SAAQ,KAAK,OAAO,EAAE,KAAK,IAAI,EAAE,SAAS;;AAI9C,KAAI,UAAU,WAAW,KAAK,OAAO,OAAO,SAAS,EACnD,OAAM,IAAI,MAAM,gCAAgC;AAGlD,QAAO;EAAE;EAAK;EAAU;;;;;;;;;;;;AAe1B,SAAgB,kBAAkB,KAGhC;CACA,MAAM,SAAS,SAAS,IAAI;CAC5B,MAAM,YAAoC,EAAE;AAG5C,KAAI,CAAC,OAAO,OAAO,WAAW,MAAM,CAClC,QAAO;EAAE,UAAU;EAAK;EAAW;CAGrC,MAAM,YAAY,OAAO,MAAM;AAC/B,KAAI,CAAC,UAAW,QAAO;EAAE,UAAU;EAAK;EAAW;CAGnD,MAAM,UAAU,MAAM,QAAQ,UAAU,GAAG,YAAY,CAAC,UAAU;AAClE,MAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,QAAQ,MAAM,QAAQ,IAAI;AAChC,MAAI,QAAQ,EACV,WAAU,MAAM,MAAM,GAAG,MAAM,IAAI,MAAM,MAAM,QAAQ,EAAE;;CAK7D,MAAM,aAAa,IAAI,QAAQ,IAAI;AACnC,KAAI,aAAa,EAAG,QAAO;EAAE,UAAU;EAAK;EAAW;CAEvD,MAAM,WAAW,IAAI,MAAM,aAAa,EAAE;CAC1C,MAAM,SAAS,IAAI,gBAAgB,SAAS;AAC5C,QAAO,OAAO,MAAM;CACpB,MAAM,WAAW,OAAO,UAAU;CAClC,MAAM,OAAO,IAAI,MAAM,GAAG,WAAW;AAGrC,QAAO;EAAE,UAFQ,WAAW,GAAG,KAAK,GAAG,aAAa;EAEjC;EAAW;;;;;;;;;AAUhC,SAAS,2BACP,OACA,UACM;AACN,KAAI,CAAC,UAAU,YAAa;CAC5B,MAAM,EAAE,4BACE,gCAAgC;CAC1C,MAAM,SAAS,SAAS,MAAM,IAAI;CAIlC,IAAI;AACJ,KAAI;AACF,iBAAe,cAAc,SAAS,aAAa,OAAO,KAAK;SACzD;AACN;;AAEF,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,aAAa,CACrD,KAAI,UAAU,QAAW;AACvB,MAAI,CAAC,MAAM,QAAS,OAAM,UAAU,EAAE;AACtC,MAAI,MAAM,QAAQ,SAAS,OACzB,OAAM,QAAQ,OAAO;;;;;;;;;;AAa7B,SAAS,uBACP,OACA,UACM;AACN,KAAI,CAAC,UAAU,YAAa;CAC5B,MAAM,EAAE,UAAU,uCACR,gCAAgC;CAC1C,MAAM,WAAW,yBAAyB,SAAS,YAAY;AAC/D,KAAI,SAAS,WAAW,EAAG;CAG3B,MAAM,SAAS,SAAS,MAAM,IAAI;CAClC,MAAM,EAAE,4BACE,gCAAgC;CAC1C,IAAI;AACJ,KAAI;AACF,iBAAe,cAAc,SAAS,aAAa,OAAO,KAAK;SACzD;AACN,iBAAe,EAAE;;CAInB,MAAM,UAA8C,EAAE,GAAG,cAAc;AACvE,MAAK,MAAM,QAAQ,SACjB,KAAI,CAAC,QAAQ,SAAS,MAAM,UAAU,SAAS,KAC7C,SAAQ,QAAQ,OAAO,MAAM,QAAQ,MAAM;AAK/C,KAAI;EACF,MAAM,SAAS,SAAS,SAAS,aAAa,QAAQ;AACtD,MAAI,WAAW,MAAM,IACnB,OAAM,MAAM;SAER;;;;;;;;;;;AAcV,eAAe,2BACb,OACA,aACA,iBACA,UACA,MAC8E;CAE9E,MAAM,OAAO,MAAM,SAAS,gBAAgB,MAAM,IAAI;CACtD,MAAM,SAAS,MAAM,UAAU;CAC/B,MAAM,eAAe,MAAM;AAE3B,KAAI,CAAC,OAAQ,QAAO;AAIpB,4BAA2B,OAAO,MAAM,SAAS;CAKjD,MAAM,EAAE,uBAAuB,MAAM,OAAO;CAC5C,MAAM,0BAA0B,mBAAmB,OAAO;CAC1D,MAAM,cAAe,OAAe,cAAc,EAAE;CACpD,MAAM,eAAe,OAAO,OAAO,YAAY,CAAC,MAAM,MAAW,MAAM,QAAQ,GAAG,IAAI,CAAC;AACvF,KAAI,wBAAwB,WAAW,KAAK,CAAC,gBAAgB,CAAC,aAAc,QAAO;CAEnF,MAAM,EAAE,uBAAuB,MAAM,OAAO;CAE5C,MAAM,SAAS,MAAM,mBAAmB;EACtC;EACA;EACA;EACA;EACA;EACA,cAAc,MAAM;EACrB,CAAC;AAEF,KAAI,CAAC,QAAQ;EAEX,MAAM,aAAa,OAAO,KAAM,OAAe,cAAc,EAAE,CAAC;EAChE,MAAM,wBAAQ,IAAI,KAAa;AAC/B,MAAI,MAAM,SAAS,OAAW,OAAM,IAAI,OAAO;AAC/C,MAAI,MAAM,UAAU,OAAW,OAAM,IAAI,QAAQ;AACjD,MAAI,MAAM,QACR,MAAK,MAAM,KAAK,OAAO,KAAK,MAAM,QAAQ,CAAE,OAAM,IAAI,EAAE;EAE1D,MAAM,UAAU,WAAW,QAAQ,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;EACvD,MAAM,YAAY,QAAQ,SAAS,IAAI,QAAQ,KAAK,KAAK,GAAG,WAAW,KAAK,KAAK;AACjF,QAAM,IAAI,MACR,wBAAwB,UAAU,4CACW,MAAM,IAAI,cAAc,MAAM,KAAK,KAAK,QAAQ,KAAK,MAAM,IAAI,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,IACrI;;AAIH,KAAI,OAAO,KAAK,OAAO,OAAO,CAAC,SAAS,GAAG;AAEzC,MAAI,OAAO,OAAO,UAAU,UAAa,MAAM,UAAU,OACvD,OAAM,QAAQ,OAAO,OAAO,OAAO,MAAM;AAE3C,MAAI,OAAO,OAAO,SAAS,UAAa,MAAM,SAAS,OACrD,OAAM,OAAO,OAAO,OAAO,OAAO,KAAK;EAIzC,MAAMC,SAAO,MAAM,WAAW,EAAE;AAChC,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,OAAO,CACtD,KAAI,QAAQ,WAAW,QAAQ,UAAUA,OAAK,SAAS,OACrD,QAAK,OAAO;AAGhB,MAAI,OAAO,KAAKA,OAAK,CAAC,SAAS,EAC7B,OAAM,UAAUA;;AAMpB,wBAAuB,OAAO,MAAM,SAAS;AAE7C,QAAO,OAAO,YAAY,SAAS;;;;;AAMrC,eAAe,wBACb,OACA,QACe;AACf,KAAI,OAAO,KAAK,OAAO,UAAU,CAAC,SAAS,EACzC,KAAI;EACF,MAAM,EAAE,0BAA0B,MAAM,OAAO;AAE/C,QADc,uBAAuB,CACzB,IAAI,MAAM,KAAK,OAAO,UAAU;UACrC,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,UAAQ,KAAK,0CAA0C,MAAM;;;;;;;;AAUnE,eAAe,uBACb,QACA,eACA,OACe;AACf,MAAK,MAAM,SAAS,OAClB,KAAI;EACF,MAAM,SAAS,MAAM,MAAM,IAAI,MAAM,IAAI;AACzC,MAAI,QAAQ;GACV,MAAM,OAAO,MAAM,WAAW,EAAE;AAChC,QAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,CAC/C,KAAI,IAAI,WAAW,OAAO,EAAE;AAE1B,QAAI,CAAC,KAAK,IAAK,MAAK,MAAM,EAAE;AAC5B,IAAC,KAAK,IAA+B,IAAI,MAAM,EAAE,IAAI;cAC5C,KAAK,SAAS,OACvB,MAAK,OAAO;AAGhB,OAAI,OAAO,KAAK,KAAK,CAAC,SAAS,EAC7B,OAAM,UAAU;;SAGd;;;;;;;;;;;;;;;;AAwDZ,eAAsB,2BACpB,SACkD;CAClD,MAAM,EAAE,KAAK,WAAW,aAAa,iBAAiB,cAAc,kBAAkB;CAGtF,MAAM,EAAE,UAAU,WAAW,cAAc,kBAAkB,IAAI;CACjE,MAAM,kBAAkB,OAAO,KAAK,UAAU,CAAC,SAAS;CAIxD,MAAM,OAAO,OADI,QAAQ,YAAY,IAAI,kBAAkB,EAC/B,gBAAgB,IAAI;CAChD,IAAI,SAAS,MAAM,UAAU;CAC7B,MAAM,eAAe,MAAM;AAG3B,KAAI,CAAC,UAAU,gBAAgB,OAAO,KAAK,aAAa,CAAC,SAAS,GAAG;EACnE,MAAM,EAAE,qBAAqB,MAAM,OAAO;AAC1C,WAAS,iBAAiB,cAAc,iBAAiB,EAAE,CAAC;;CAI9D,MAAM,sBAA+D;AACnE,MAAI,CAAC,gBAAiB,QAAO;AAC7B,SAAO;GACL,WAAW;GACX,cAAc,EAAE;GAChB,WAAW,EAAE;GACb,oBAAoB,YAAY;IAC9B,MAAM,UAAkC,EAAE;AAC1C,SAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,UAAU,CAChD,SAAQ,OAAO,SAAS;AAE1B,QAAI,gBACF,KAAI;AACF,WAAM,gBAAgB,IAAI,WAAW,QAAQ;aACtC,KAAK;KACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,aAAQ,KAAK,8CAA8C,MAAM;;;GAIvE,iBAAiB,EAAE;GACnB;GACD;;AAGH,KAAI,CAAC,OAAQ,QAAO,eAAe;CAEnC,MAAM,aAAc,OAAe;AACnC,KAAI,CAAC,cAAc,OAAO,KAAK,WAAW,CAAC,WAAW,EAAG,QAAO,eAAe;AAI/E,KAAI,iBAAiB,cAAc,SAAS,GAAG;EAC7C,MAAM,cAAc,EAAE,GAAG,YAAY;EACrC,IAAI,UAAU;AACd,OAAK,MAAM,SAAS,cAClB,KAAI,YAAY,QAAQ;AAEtB,eAAY,SAAS;IAAE,GAAG,YAAY;IAAQ,WAAW;IAAM;AAC/D,aAAU;aACD,eAAe,WAAW,QAAW;GAE9C,MAAM,QAAQ,aAAa;AAC3B,eAAY,SAAS;IACnB,MACE,OAAO,UAAU,WACb,WACA,OAAO,UAAU,YACf,YACA;IACR,WAAW;IACZ;AACD,aAAU;;AAGd,MAAI,QACF,UAAS;GAAE,GAAG;GAAQ,YAAY;GAAa;;CAQnD,MAAM,EAAE,uBAAuB,MAAM,OAAO;CAC5C,MAAM,0BAA0B,mBAAmB,OAAO;CAC1D,MAAM,cAAe,OAAe;CACpC,MAAM,eAAe,OAAO,OAAO,YAAY,CAAC,MAAM,MAAW,MAAM,QAAQ,GAAG,IAAI,CAAC;AACvF,KAAI,wBAAwB,WAAW,KAAK,CAAC,gBAAgB,CAAC,aAC5D,QAAO,eAAe;CAGxB,MAAM,QAAqB;EAAE;EAAK,MAAM;EAAW;AAGnD,KAAI,gBAAgB,OAAO,KAAK,aAAa,CAAC,SAAS,EACrD,OAAM,UAAU;EAAE,GAAI,MAAM,WAAW,EAAE;EAAG,GAAG;EAAc;AAI/D,4BAA2B,OAAO,MAAM,SAAS;CAGjD,MAAM,EAAE,uBAAuB,MAAM,OAAO;CAE5C,MAAM,SAAS,MAAM,mBAAmB;EACtC;EACA;EACA;EACA;EACA;EACA,cAAc,QAAQ;EACvB,CAAC;AAEF,KAAI,CAAC,QAAQ;EAEX,MAAM,aAAa,OAAO,KAAK,WAAW;AAC1C,QAAM,IAAI,MACR,wBAAwB,WAAW,KAAK,KAAK,CAAC,4CACD,IAAI,cAAc,UAAU,KAAK,WAAW,KAAK,MAAM,IAAI,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,IACjI;;CAIH,MAAM,oBAAoB,IAAI,IAAI,wBAAwB;CAI1D,MAAM,gBAAwC,EAAE;AAChD,MAAK,MAAM,SAAS,yBAAyB;EAC3C,MAAM,MAAM,OAAO,OAAO;AAC1B,MAAI,QAAQ,OAAW;AACvB,MAAI,UAAU,SAAS,OAAO,QAAQ,YAAY,QAAQ,KACxD,MAAK,MAAM,CAAC,QAAQ,WAAW,OAAO,QAAQ,IAA8B,CAC1E,eAAc,OAAO,YAAY,OAAO,OAAO;MAGjD,eAAc,SAAS,OAAO,IAAI;;CAKtC,MAAM,eAAwC,OAAO,YACjD,OAAO,eACP,eACE,OAAO,YAAY,OAAO,QAAQ,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAC3F,EAAE;CAIR,MAAM,qBAAqB,YAAY;EACrC,MAAM,UAAU,EAAE,GAAG,eAAe;AAEpC,OAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,UAAU,CAChD,SAAQ,OAAO,SAAS;AAE1B,MAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,KAAK,gBACrC,KAAI;AAEF,SAAM,gBAAgB,IAAI,WAAW,QAAQ;WACtC,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,8CAA8C,MAAM;;;AAKvE,QAAO;EACL,WAAW,OAAO;EAClB;EACA,WAAW,OAAO;EAClB;EACA,iBAAiB;EACjB,WAAW,kBAAkB,YAAY;EAC1C;;;;;;;;;;;;;AAgBH,eAAsB,YACpB,KACA,WACA,SACe;CACf,MAAM,QAAqB;EACzB;EACA,MAAM;EACN,SAAS,WAAW,OAAO,KAAK,QAAQ,CAAC,SAAS,IAAI,UAAU;EACjE;CAED,MAAM,WAAW,IAAI,kBAAkB;AACvC,0BAAyB,SAAS;CAClC,IAAI;AACJ,KAAI;AACF,aAAW,MAAM,SAAS,eAAe,MAAM;UACxC,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,kDAAkD,MAAM;;AAI1E,KAAI;EACF,MAAM,EAAE,eAAQ,MAAM,OAAO;AAE7B,QADgB,IAAIC,OAAK,CACX,MAAM,UAAU,UAAU;UACjC,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MACR,0DAA0D,IAAI,WAClD,IAAI,mCACjB;WACO;AAER,MAAI,OAAQ,SAAiB,UAAU,WACrC,KAAI;AACF,SAAO,SAAiB,OAAO;UACzB"}
+{"version":3,"file":"afs-loader.mjs","names":["resolve","options","registry","AFS"],"sources":["../../src/config/afs-loader.ts"],"sourcesContent":["/**\n * AFS Loader - Lazy loading with parallel tolerant mount\n *\n * Provides loadAFS() for on-demand AFS creation with caching.\n * createAFS() uses Promise.allSettled for parallel provider creation + mount,\n * tolerating individual failures while reporting them to stderr.\n *\n * Integrates 4-step credential resolution:\n * 1. Determine missing fields from provider schema\n * 2. Silent resolution (config > env > credential store)\n * 3. Interactive collection (provider auth() or default collect())\n * 4. Unified persistence (sensitive → credentials.toml, non-sensitive → config options)\n */\n\nimport { mkdir } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { AFSModule, AuthContext, MountConfig } from \"@aigne/afs\";\nimport { AFS, ProviderRegistry } from \"@aigne/afs\";\nimport { parseURI } from \"@aigne/afs/utils/uri\";\nimport type { CredentialStore } from \"../credential/store.js\";\nimport {\n  extractEnvFromURI,\n  mergeStoredCredentials,\n  persistCredentialResult,\n  type ResolveCredentialsForMountOptions,\n  type ResolveCredentialsForMountResult,\n  resolveAndMergeCredentials,\n  resolveCredentialsForMount,\n} from \"./credential-helpers.js\";\nimport { AFS_USER_CONFIG_DIR_ENV, CONFIG_DIR_NAME, ConfigLoader } from \"./loader.js\";\nimport {\n  type ConfigMountEntry,\n  type PersistScope,\n  persistMount,\n  unpersistMount,\n  updateMountOptions,\n} from \"./mount-commands.js\";\n\n// Re-export credential helpers for backward compatibility\nexport {\n  extractEnvFromURI,\n  resolveCredentialsForMount,\n  type ResolveCredentialsForMountOptions,\n  type ResolveCredentialsForMountResult,\n};\n\n// ─── Workspace Factory Helper ─────────────────────────────────────────────\n\n/**\n * Register the workspace:// scheme on a ProviderRegistry.\n *\n * Extracted so that both createAFS() and verifyMount() can support\n * workspace URIs. createAFS() overrides this with a richer variant\n * that includes credential resolution.\n */\nfunction registerWorkspaceFactory(registry: import(\"@aigne/afs\").ProviderRegistry): void {\n  registry.register(\"workspace\", async (mount, parsed) => {\n    const mod = await import(\"@aigne/afs-workspace\" as string);\n    const AFSWorkspace = mod.AFSWorkspace ?? mod.default;\n    if (!AFSWorkspace) {\n      throw new Error(\n        \"workspace:// scheme requires @aigne/afs-workspace package. Install it with: pnpm add @aigne/afs-workspace\",\n      );\n    }\n    return new AFSWorkspace({\n      workspacePath: parsed.body,\n      registry,\n      name: mount.path.slice(1).replace(/\\//g, \"-\") || \"workspace\",\n      description: mount.description,\n      accessMode: mount.access_mode,\n      ...mount.options,\n    });\n  });\n}\n\n// ─── Types ────────────────────────────────────────────────────────────────\n\nexport interface MountProgressEvent {\n  total: number;\n  completed: number;\n  failed: number;\n}\n\nexport interface MountFailure {\n  path: string;\n  reason: string;\n}\n\nexport interface CreateAFSResult {\n  afs: AFS;\n  failures: MountFailure[];\n  /** Mount paths that were successfully loaded from config.toml (excludes code-managed mounts). */\n  configMountPaths: string[];\n  /** Provider registry with all registered factories (workspace, etc.). */\n  registry: import(\"@aigne/afs\").ProviderRegistry;\n}\n\nexport interface CreateAFSOptions {\n  onProgress?: (event: MountProgressEvent) => void;\n  /** Auth context for interactive credential collection (CLI or MCP) */\n  authContext?: AuthContext;\n  /** Credential store for reading/writing credentials */\n  credentialStore?: CredentialStore;\n}\n\n// ─── Cache ────────────────────────────────────────────────────────────────\n\nconst cacheMap = new Map<string, AFS>();\n\nfunction cacheKey(cwd: string): string {\n  const { resolve } = require(\"node:path\") as typeof import(\"node:path\");\n  return resolve(cwd);\n}\n\n/**\n * Reset all cached AFS instances (for testing)\n */\nexport function resetAFSCache(): void {\n  cacheMap.clear();\n}\n\n/**\n * Load AFS with per-cwd caching — same cwd returns same instance,\n * different cwd creates a separate instance.\n */\nexport async function loadAFS(cwd: string, options?: CreateAFSOptions): Promise<CreateAFSResult> {\n  const key = cacheKey(cwd);\n  const cached = cacheMap.get(key);\n  if (cached)\n    return { afs: cached, failures: [], configMountPaths: [], registry: new ProviderRegistry() };\n  const result = await createAFS(cwd, options);\n  cacheMap.set(key, result.afs);\n  return result;\n}\n\n/**\n * Create AFS instance from config with parallel tolerant mount\n *\n * - All providers are created and mounted in parallel via Promise.allSettled\n * - Individual failures are logged to stderr and skipped (unless onProgress is provided)\n * - If ALL providers fail, throws an error\n * - If no mounts configured, returns empty AFS (no error)\n */\nexport async function createAFS(cwd: string, options?: CreateAFSOptions): Promise<CreateAFSResult> {\n  const loader = new ConfigLoader();\n  const { config, mountSources } = await loader.loadWithSources(cwd);\n  const afs = new AFS();\n  const authContext = options?.authContext;\n  const credentialStore = options?.credentialStore;\n\n  // Create registry — auto-loads built-in providers via manifest-driven resolution.\n  // Only workspace needs explicit registration (to break circular deps + inject credential callback).\n  const registry = new ProviderRegistry();\n  registry.register(\"workspace\", async (mount, parsed) => {\n    const mod = await import(\"@aigne/afs-workspace\" as string);\n    const AFSWorkspace = mod.AFSWorkspace ?? mod.default;\n    if (!AFSWorkspace) {\n      throw new Error(\n        \"workspace:// scheme requires @aigne/afs-workspace package. Install it with: pnpm add @aigne/afs-workspace\",\n      );\n    }\n    const { resolve } = await import(\"node:path\");\n    const _workspacePath = resolve(parsed.body);\n    return new AFSWorkspace({\n      workspacePath: parsed.body,\n      registry,\n      createProvider: async (subMount: MountConfig) => {\n        const credResult = await resolveAndMergeCredentials(\n          subMount,\n          authContext,\n          credentialStore,\n          registry,\n        );\n        // Create provider with resolved credentials in mount.options\n        const provider = await registry.createProvider(subMount);\n        // Persist sensitive credentials to credential store\n        if (credResult) {\n          await persistCredentialResult(subMount, credResult);\n          // Strip sensitive values from mount.options (keep only non-sensitive for config)\n          const opts = subMount.options ?? {};\n          for (const key of Object.keys(credResult.sensitive)) {\n            delete opts[key];\n          }\n          subMount.options = Object.keys(opts).length > 0 ? opts : undefined;\n          // Merge non-sensitive resolved values back\n          if (Object.keys(credResult.nonSensitive).length > 0) {\n            subMount.options = { ...(subMount.options ?? {}), ...credResult.nonSensitive };\n          }\n        }\n        return provider;\n      },\n      name: mount.path.slice(1).replace(/\\//g, \"-\") || \"workspace\",\n      description: mount.description,\n      accessMode: mount.access_mode,\n      ...mount.options,\n    });\n  });\n\n  // ── Inject provider factory for program mount fallback ──\n  // Handles credential resolution + registry creation for program mounts\n  // when shared mount URI isn't found in host AFS.\n  afs.createProviderFromMount = async (mount) => {\n    await resolveAndMergeCredentials(mount, authContext, credentialStore, registry);\n    return registry.createProvider(mount);\n  };\n\n  // ── Inject loadProvider ──\n  // Allows agents to mount new providers at runtime via /.actions/mount\n  afs.loadProvider = async (uri: string, mountPath: string, options?: Record<string, unknown>) => {\n    // Validate URI format before passing to factory\n    parseURI(uri);\n\n    // Extract env query params from MCP URIs for secure credential storage\n    const { cleanUri: loadConfigUri, envRecord: loadEnvRecord } = extractEnvFromURI(uri);\n    const hasLoadEnv = Object.keys(loadEnvRecord).length > 0;\n\n    // Extract known mount-level fields; pass remaining as provider-specific options\n    const { accessMode, auth, description, scope, ...providerOptions } = options ?? {};\n\n    // Inject extracted env values into provider options\n    if (hasLoadEnv) {\n      const existingEnv = (providerOptions.env as Record<string, string>) ?? {};\n      providerOptions.env = { ...existingEnv, ...loadEnvRecord };\n    }\n\n    const mount: MountConfig = {\n      uri,\n      path: mountPath,\n      access_mode: (accessMode as \"readonly\" | \"readwrite\") ?? undefined,\n      auth: (auth as string) ?? undefined,\n      description: (description as string) ?? undefined,\n      options: Object.keys(providerOptions).length > 0 ? providerOptions : undefined,\n    };\n\n    const persistScope = (scope as PersistScope) || \"cwd\";\n    let credResult = await resolveAndMergeCredentials(\n      mount,\n      authContext,\n      credentialStore,\n      registry,\n    );\n\n    try {\n      const provider = await registry.createProvider(mount);\n      await afs.mount(provider, mountPath);\n    } catch (mountError) {\n      // Health check failed with silently resolved credentials →\n      // retry once with forced interactive collection so user can fix values\n      if (credResult === null && authContext) {\n        // credResult === null means all fields resolved silently (no interactive collection)\n        // Rebuild mount config from scratch for retry\n        const retryProviderOptions = { ...providerOptions };\n        const retryMount: MountConfig = {\n          uri,\n          path: mountPath,\n          access_mode: (accessMode as \"readonly\" | \"readwrite\") ?? undefined,\n          auth: (auth as string) ?? undefined,\n          description: (description as string) ?? undefined,\n          options: Object.keys(retryProviderOptions).length > 0 ? retryProviderOptions : undefined,\n        };\n        credResult = await resolveAndMergeCredentials(\n          retryMount,\n          authContext,\n          credentialStore,\n          registry,\n          { forceCollect: true },\n        );\n        const retryProvider = await registry.createProvider(retryMount);\n        await afs.mount(retryProvider, mountPath);\n        // Update mount reference for persistence below\n        Object.assign(mount, retryMount);\n      } else {\n        throw mountError;\n      }\n    }\n\n    // Persist credentials if any were collected\n    if (credResult) {\n      await persistCredentialResult(mount, credResult);\n    }\n\n    // Persist extracted MCP env values to credentials.toml\n    if (hasLoadEnv && credentialStore) {\n      try {\n        const envCreds: Record<string, string> = {};\n        for (const [k, v] of Object.entries(loadEnvRecord)) {\n          envCreds[`env:${k}`] = v;\n        }\n        // Merge with any existing sensitive values from credential resolution\n        const existing = credResult ? { ...credResult.sensitive } : {};\n        await credentialStore.set(loadConfigUri, { ...existing, ...envCreds });\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.warn(`[mount] env credential persistence failed: ${msg}`);\n      }\n    }\n\n    // Always persist to config after successful mount\n    try {\n      // Use configUri (env stripped) for config.toml — env values are in credentials.toml\n      const entry: ConfigMountEntry = {\n        path: mountPath,\n        uri: hasLoadEnv ? loadConfigUri : mount.uri,\n      };\n      if (description) entry.description = description as string;\n      if (accessMode) entry.access_mode = accessMode as \"readonly\" | \"readwrite\";\n      if (auth) entry.auth = auth as string;\n      const mergedOptions = { ...providerOptions, ...credResult?.nonSensitive };\n      // Strip env from config options — it's in credentials.toml\n      if (hasLoadEnv) delete mergedOptions.env;\n      if (Object.keys(mergedOptions).length > 0) entry.options = mergedOptions;\n      await persistMount(cwd, entry, persistScope);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[mount] config persistence failed: ${msg}`);\n    }\n  };\n\n  // ── Inject unloadProvider ──\n  // Removes mount config when provider is unmounted via /.actions/unmount\n  afs.unloadProvider = async (mountPath: string, options?: Record<string, unknown>) => {\n    try {\n      await unpersistMount(cwd, mountPath, (options?.scope as PersistScope) || undefined);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[unmount] config removal failed: ${msg}`);\n    }\n  };\n\n  // ── Inject updateProviderConfig ──\n  // Allows providers to persist option changes back to their config file\n  afs.updateProviderConfig = async (mountPath: string, optionUpdates: Record<string, unknown>) => {\n    try {\n      const key = `:${mountPath}`;\n      const configDir = mountSources.get(key);\n      if (!configDir) return;\n      await updateMountOptions(configDir, mountPath, optionUpdates);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.warn(`[updateProviderConfig] failed: ${msg}`);\n    }\n  };\n\n  // ── Auto-mount Registry (tolerant — silent on failure) ──\n  // Scans locally installed @aigne/afs-* packages at runtime.\n  if (config.registry?.enabled !== false) {\n    try {\n      const { AFSRegistry } = await import(\"@aigne/afs-registry\");\n      const registry = new AFSRegistry(\n        config.registry?.providers?.length\n          ? { providers: config.registry.providers as any[] }\n          : undefined,\n      );\n      await afs.mount(registry, \"/registry\");\n    } catch {\n      // Silent degradation — registry is optional\n    }\n  }\n\n  if (config.mounts.length === 0) {\n    return { afs, failures: [], configMountPaths: [], registry };\n  }\n\n  const total = config.mounts.length;\n  let completed = 0;\n  let failedCount = 0;\n\n  options?.onProgress?.({ total, completed: 0, failed: 0 });\n\n  // Load stored credentials keyed by URI\n  if (credentialStore && mountSources.size > 0) {\n    await mergeStoredCredentials(config.mounts, mountSources, credentialStore);\n  }\n\n  const results = await Promise.allSettled(\n    config.mounts.map(async (mount) => {\n      const provider = await registry.createProvider(mount);\n      await afs.mount(provider, mount.path, { namespace: mount.namespace ?? null });\n      completed++;\n      options?.onProgress?.({ total, completed, failed: failedCount });\n      return mount.path;\n    }),\n  );\n\n  const failures: MountFailure[] = [];\n  const succeeded: string[] = [];\n\n  for (let i = 0; i < results.length; i++) {\n    const result = results[i]!;\n    if (result.status === \"fulfilled\") {\n      succeeded.push(result.value);\n    } else {\n      const reason = result.reason;\n      const msg = reason instanceof Error ? reason.message : String(reason);\n      failures.push({ path: config.mounts[i]!.path, reason: msg });\n      failedCount++;\n      completed++;\n      options?.onProgress?.({ total, completed, failed: failedCount });\n    }\n  }\n\n  // When onProgress is provided, the caller handles display; otherwise log to stderr\n  if (!options?.onProgress && failures.length > 0) {\n    console.warn(`[mount] ${succeeded.length} succeeded, ${failures.length} failed:`);\n    for (const f of failures) {\n      console.warn(`  - ${f.path}: ${f.reason}`);\n    }\n  }\n\n  if (succeeded.length === 0 && config.mounts.length > 0) {\n    throw new Error(\"All providers failed to mount\");\n  }\n\n  // Auto-mount program data directory from user's home ~/.afs-config/data/\n  // Always use user-level config dir so program data persists across projects\n  {\n    const userConfigDir = process.env[AFS_USER_CONFIG_DIR_ENV] ?? join(homedir(), CONFIG_DIR_NAME);\n    const dataDir = join(userConfigDir, \"data\");\n    try {\n      await mkdir(dataDir, { recursive: true });\n      const dataProvider = await registry.createProvider({\n        uri: `fs://${dataDir}`,\n        path: \"/.data\",\n        access_mode: \"readwrite\",\n      });\n      await afs.mount(dataProvider, \"/.data\");\n    } catch {\n      // Non-critical: program data mount is optional\n    }\n  }\n\n  return { afs, failures, configMountPaths: succeeded, registry };\n}\n\n// ─── Mount Verification ───────────────────────────────────────────────────────\n\n/**\n * Verify that a mount configuration produces a working provider.\n *\n * Creates the provider and mounts it on a temporary AFS instance,\n * which triggers the built-in checkProviderOnMount (stat + data validation + list).\n * Throws if the mount check fails.\n *\n * @param uri - Provider URI\n * @param mountPath - Mount path\n * @param options - Merged options (non-sensitive + sensitive) for provider creation\n */\nexport async function verifyMount(\n  uri: string,\n  mountPath: string,\n  options?: Record<string, unknown>,\n): Promise<void> {\n  const mount: MountConfig = {\n    uri,\n    path: mountPath,\n    options: options && Object.keys(options).length > 0 ? options : undefined,\n  };\n\n  const registry = new ProviderRegistry();\n  registerWorkspaceFactory(registry);\n  let provider: AFSModule;\n  try {\n    provider = await registry.createProvider(mount);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`Mount verification failed (provider creation): ${msg}`);\n  }\n\n  // Mount on a temporary AFS to trigger the real checkProviderOnMount\n  try {\n    const { AFS } = await import(\"@aigne/afs\");\n    const tempAFS = new AFS();\n    await tempAFS.mount(provider, mountPath);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(\n      `Mount verification failed: could not reach provider at ${uri}. ` +\n        `Error: ${msg}. Check your URI and credentials.`,\n    );\n  } finally {\n    // Clean up provider resources (e.g., MCP process)\n    try {\n      await provider.close?.();\n    } catch {\n      // ignore cleanup errors\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDA,SAAS,yBAAyB,UAAuD;AACvF,UAAS,SAAS,aAAa,OAAO,OAAO,WAAW;EACtD,MAAM,MAAM,MAAM,OAAO;EACzB,MAAM,eAAe,IAAI,gBAAgB,IAAI;AAC7C,MAAI,CAAC,aACH,OAAM,IAAI,MACR,4GACD;AAEH,SAAO,IAAI,aAAa;GACtB,eAAe,OAAO;GACtB;GACA,MAAM,MAAM,KAAK,MAAM,EAAE,CAAC,QAAQ,OAAO,IAAI,IAAI;GACjD,aAAa,MAAM;GACnB,YAAY,MAAM;GAClB,GAAG,MAAM;GACV,CAAC;GACF;;AAmCJ,MAAM,2BAAW,IAAI,KAAkB;AAEvC,SAAS,SAAS,KAAqB;CACrC,MAAM,EAAE,iCAAoB,YAAY;AACxC,QAAOA,UAAQ,IAAI;;;;;;AAcrB,eAAsB,QAAQ,KAAa,SAAsD;CAC/F,MAAM,MAAM,SAAS,IAAI;CACzB,MAAM,SAAS,SAAS,IAAI,IAAI;AAChC,KAAI,OACF,QAAO;EAAE,KAAK;EAAQ,UAAU,EAAE;EAAE,kBAAkB,EAAE;EAAE,UAAU,IAAI,kBAAkB;EAAE;CAC9F,MAAM,SAAS,MAAM,UAAU,KAAK,QAAQ;AAC5C,UAAS,IAAI,KAAK,OAAO,IAAI;AAC7B,QAAO;;;;;;;;;;AAWT,eAAsB,UAAU,KAAa,SAAsD;CAEjG,MAAM,EAAE,QAAQ,iBAAiB,MADlB,IAAI,cAAc,CACa,gBAAgB,IAAI;CAClE,MAAM,MAAM,IAAI,KAAK;CACrB,MAAM,cAAc,SAAS;CAC7B,MAAM,kBAAkB,SAAS;CAIjC,MAAM,WAAW,IAAI,kBAAkB;AACvC,UAAS,SAAS,aAAa,OAAO,OAAO,WAAW;EACtD,MAAM,MAAM,MAAM,OAAO;EACzB,MAAM,eAAe,IAAI,gBAAgB,IAAI;AAC7C,MAAI,CAAC,aACH,OAAM,IAAI,MACR,4GACD;EAEH,MAAM,EAAE,uBAAY,MAAM,OAAO;AACV,YAAQ,OAAO,KAAK;AAC3C,SAAO,IAAI,aAAa;GACtB,eAAe,OAAO;GACtB;GACA,gBAAgB,OAAO,aAA0B;IAC/C,MAAM,aAAa,MAAM,2BACvB,UACA,aACA,iBACA,SACD;IAED,MAAM,WAAW,MAAM,SAAS,eAAe,SAAS;AAExD,QAAI,YAAY;AACd,WAAM,wBAAwB,UAAU,WAAW;KAEnD,MAAM,OAAO,SAAS,WAAW,EAAE;AACnC,UAAK,MAAM,OAAO,OAAO,KAAK,WAAW,UAAU,CACjD,QAAO,KAAK;AAEd,cAAS,UAAU,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO;AAEzD,SAAI,OAAO,KAAK,WAAW,aAAa,CAAC,SAAS,EAChD,UAAS,UAAU;MAAE,GAAI,SAAS,WAAW,EAAE;MAAG,GAAG,WAAW;MAAc;;AAGlF,WAAO;;GAET,MAAM,MAAM,KAAK,MAAM,EAAE,CAAC,QAAQ,OAAO,IAAI,IAAI;GACjD,aAAa,MAAM;GACnB,YAAY,MAAM;GAClB,GAAG,MAAM;GACV,CAAC;GACF;AAKF,KAAI,0BAA0B,OAAO,UAAU;AAC7C,QAAM,2BAA2B,OAAO,aAAa,iBAAiB,SAAS;AAC/E,SAAO,SAAS,eAAe,MAAM;;AAKvC,KAAI,eAAe,OAAO,KAAa,WAAmB,cAAsC;AAE9F,WAAS,IAAI;EAGb,MAAM,EAAE,UAAU,eAAe,WAAW,kBAAkB,kBAAkB,IAAI;EACpF,MAAM,aAAa,OAAO,KAAK,cAAc,CAAC,SAAS;EAGvD,MAAM,EAAE,YAAY,MAAM,aAAa,OAAO,GAAG,oBAAoBC,aAAW,EAAE;AAGlF,MAAI,WAEF,iBAAgB,MAAM;GAAE,GADH,gBAAgB,OAAkC,EAAE;GACjC,GAAG;GAAe;EAG5D,MAAM,QAAqB;GACzB;GACA,MAAM;GACN,aAAc,cAA2C;GACzD,MAAO,QAAmB;GAC1B,aAAc,eAA0B;GACxC,SAAS,OAAO,KAAK,gBAAgB,CAAC,SAAS,IAAI,kBAAkB;GACtE;EAED,MAAM,eAAgB,SAA0B;EAChD,IAAI,aAAa,MAAM,2BACrB,OACA,aACA,iBACA,SACD;AAED,MAAI;GACF,MAAM,WAAW,MAAM,SAAS,eAAe,MAAM;AACrD,SAAM,IAAI,MAAM,UAAU,UAAU;WAC7B,YAAY;AAGnB,OAAI,eAAe,QAAQ,aAAa;IAGtC,MAAM,uBAAuB,EAAE,GAAG,iBAAiB;IACnD,MAAM,aAA0B;KAC9B;KACA,MAAM;KACN,aAAc,cAA2C;KACzD,MAAO,QAAmB;KAC1B,aAAc,eAA0B;KACxC,SAAS,OAAO,KAAK,qBAAqB,CAAC,SAAS,IAAI,uBAAuB;KAChF;AACD,iBAAa,MAAM,2BACjB,YACA,aACA,iBACA,UACA,EAAE,cAAc,MAAM,CACvB;IACD,MAAM,gBAAgB,MAAM,SAAS,eAAe,WAAW;AAC/D,UAAM,IAAI,MAAM,eAAe,UAAU;AAEzC,WAAO,OAAO,OAAO,WAAW;SAEhC,OAAM;;AAKV,MAAI,WACF,OAAM,wBAAwB,OAAO,WAAW;AAIlD,MAAI,cAAc,gBAChB,KAAI;GACF,MAAM,WAAmC,EAAE;AAC3C,QAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,cAAc,CAChD,UAAS,OAAO,OAAO;GAGzB,MAAM,WAAW,aAAa,EAAE,GAAG,WAAW,WAAW,GAAG,EAAE;AAC9D,SAAM,gBAAgB,IAAI,eAAe;IAAE,GAAG;IAAU,GAAG;IAAU,CAAC;WAC/D,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,8CAA8C,MAAM;;AAKrE,MAAI;GAEF,MAAM,QAA0B;IAC9B,MAAM;IACN,KAAK,aAAa,gBAAgB,MAAM;IACzC;AACD,OAAI,YAAa,OAAM,cAAc;AACrC,OAAI,WAAY,OAAM,cAAc;AACpC,OAAI,KAAM,OAAM,OAAO;GACvB,MAAM,gBAAgB;IAAE,GAAG;IAAiB,GAAG,YAAY;IAAc;AAEzE,OAAI,WAAY,QAAO,cAAc;AACrC,OAAI,OAAO,KAAK,cAAc,CAAC,SAAS,EAAG,OAAM,UAAU;AAC3D,SAAM,aAAa,KAAK,OAAO,aAAa;WACrC,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,sCAAsC,MAAM;;;AAM7D,KAAI,iBAAiB,OAAO,WAAmB,cAAsC;AACnF,MAAI;AACF,SAAM,eAAe,KAAK,WAAYA,WAAS,SAA0B,OAAU;WAC5E,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,oCAAoC,MAAM;;;AAM3D,KAAI,uBAAuB,OAAO,WAAmB,kBAA2C;AAC9F,MAAI;GACF,MAAM,MAAM,IAAI;GAChB,MAAM,YAAY,aAAa,IAAI,IAAI;AACvC,OAAI,CAAC,UAAW;AAChB,SAAM,mBAAmB,WAAW,WAAW,cAAc;WACtD,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,KAAK,kCAAkC,MAAM;;;AAMzD,KAAI,OAAO,UAAU,YAAY,MAC/B,KAAI;EACF,MAAM,EAAE,gBAAgB,MAAM,OAAO;EACrC,MAAMC,aAAW,IAAI,YACnB,OAAO,UAAU,WAAW,SACxB,EAAE,WAAW,OAAO,SAAS,WAAoB,GACjD,OACL;AACD,QAAM,IAAI,MAAMA,YAAU,YAAY;SAChC;AAKV,KAAI,OAAO,OAAO,WAAW,EAC3B,QAAO;EAAE;EAAK,UAAU,EAAE;EAAE,kBAAkB,EAAE;EAAE;EAAU;CAG9D,MAAM,QAAQ,OAAO,OAAO;CAC5B,IAAI,YAAY;CAChB,IAAI,cAAc;AAElB,UAAS,aAAa;EAAE;EAAO,WAAW;EAAG,QAAQ;EAAG,CAAC;AAGzD,KAAI,mBAAmB,aAAa,OAAO,EACzC,OAAM,uBAAuB,OAAO,QAAQ,cAAc,gBAAgB;CAG5E,MAAM,UAAU,MAAM,QAAQ,WAC5B,OAAO,OAAO,IAAI,OAAO,UAAU;EACjC,MAAM,WAAW,MAAM,SAAS,eAAe,MAAM;AACrD,QAAM,IAAI,MAAM,UAAU,MAAM,MAAM,EAAE,WAAW,MAAM,aAAa,MAAM,CAAC;AAC7E;AACA,WAAS,aAAa;GAAE;GAAO;GAAW,QAAQ;GAAa,CAAC;AAChE,SAAO,MAAM;GACb,CACH;CAED,MAAM,WAA2B,EAAE;CACnC,MAAM,YAAsB,EAAE;AAE9B,MAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;EACvC,MAAM,SAAS,QAAQ;AACvB,MAAI,OAAO,WAAW,YACpB,WAAU,KAAK,OAAO,MAAM;OACvB;GACL,MAAM,SAAS,OAAO;GACtB,MAAM,MAAM,kBAAkB,QAAQ,OAAO,UAAU,OAAO,OAAO;AACrE,YAAS,KAAK;IAAE,MAAM,OAAO,OAAO,GAAI;IAAM,QAAQ;IAAK,CAAC;AAC5D;AACA;AACA,YAAS,aAAa;IAAE;IAAO;IAAW,QAAQ;IAAa,CAAC;;;AAKpE,KAAI,CAAC,SAAS,cAAc,SAAS,SAAS,GAAG;AAC/C,UAAQ,KAAK,WAAW,UAAU,OAAO,cAAc,SAAS,OAAO,UAAU;AACjF,OAAK,MAAM,KAAK,SACd,SAAQ,KAAK,OAAO,EAAE,KAAK,IAAI,EAAE,SAAS;;AAI9C,KAAI,UAAU,WAAW,KAAK,OAAO,OAAO,SAAS,EACnD,OAAM,IAAI,MAAM,gCAAgC;CAKlD;EAEE,MAAM,UAAU,KADM,QAAQ,IAAI,4BAA4B,KAAK,SAAS,EAAE,gBAAgB,EAC1D,OAAO;AAC3C,MAAI;AACF,SAAM,MAAM,SAAS,EAAE,WAAW,MAAM,CAAC;GACzC,MAAM,eAAe,MAAM,SAAS,eAAe;IACjD,KAAK,QAAQ;IACb,MAAM;IACN,aAAa;IACd,CAAC;AACF,SAAM,IAAI,MAAM,cAAc,SAAS;UACjC;;AAKV,QAAO;EAAE;EAAK;EAAU,kBAAkB;EAAW;EAAU;;;;;;;;;;;;;AAgBjE,eAAsB,YACpB,KACA,WACA,SACe;CACf,MAAM,QAAqB;EACzB;EACA,MAAM;EACN,SAAS,WAAW,OAAO,KAAK,QAAQ,CAAC,SAAS,IAAI,UAAU;EACjE;CAED,MAAM,WAAW,IAAI,kBAAkB;AACvC,0BAAyB,SAAS;CAClC,IAAI;AACJ,KAAI;AACF,aAAW,MAAM,SAAS,eAAe,MAAM;UACxC,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MAAM,kDAAkD,MAAM;;AAI1E,KAAI;EACF,MAAM,EAAE,eAAQ,MAAM,OAAO;AAE7B,QADgB,IAAIC,OAAK,CACX,MAAM,UAAU,UAAU;UACjC,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAM,IAAI,MACR,0DAA0D,IAAI,WAClD,IAAI,mCACjB;WACO;AAER,MAAI;AACF,SAAM,SAAS,SAAS;UAClB"}