@geminixiang/mikan 1.0.0-beta.4 → 1.0.0-beta.41

package/dist/packages/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/packages/source.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAKhE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQzD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAsCxD;AA2CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,eAAe,CAIpE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAc/C;AAgBD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAKzD"}

package/dist/packages/source.js

@@ -0,0 +1,189 @@
+/**
+ * The package source grammar: one place that turns a human-written source
+ * string into a {@link ParsedSource}, and one place that decides when two
+ * sources are the same package ({@link sourceIdentity}).
+ *
+ * Only git and local-path sources are implemented. The tagged union and the
+ * identity function are the seams a future `npm:` source slots into: adding it
+ * means a new arm here and a new materializer, with nothing downstream —
+ * resolution, scope precedence, the portal — needing to know.
+ *
+ * Grammar:
+ *
+ *   <locator>[@<ref>][#<subpath>]
+ *
+ *   locator: https://…  http://…  ssh://…  git://…  file://…
+ *            git@host:owner/repo
+ *            git:<any of the above, or host/owner/repo shorthand>
+ *            github:owner/repo
+ *            /abs/path  ./rel/path        (local, used by reference)
+ *
+ * `@<ref>` is recognized only when what follows the last `@` contains no `/`
+ * and no `:` — otherwise the `@` belongs to the URL's authority
+ * (`git@github.com:…`). A consequence: refs containing a slash
+ * (`release/1.0`) cannot be written in the string form; pin to a tag or a
+ * commit sha instead. The admin portal takes the URL and the ref as separate
+ * inputs and assembles a canonical string, so this only constrains
+ * hand-edited settings.
+ */
+import { isAbsolute, resolve } from "node:path";
+const PROTOCOL_PREFIXES = ["https://", "http://", "ssh://", "git://", "file://"];
+const SCP_LIKE = /^[^@/\s]+@[^:/\s]+:/;
+/**
+ * Whether a source string spells a git source (vs a local path) — the one
+ * home of the prefix rule. Classification only; `parseSource` still owns
+ * validation and error messages.
+ */
+export function isGitSourceString(source) {
+    const locator = source.trim();
+    return (locator.startsWith("github:") ||
+        locator.startsWith("git:") ||
+        isProtocolUrl(locator) ||
+        SCP_LIKE.test(locator));
+}
+/**
+ * Parse a source string. Throws with a user-facing message rather than
+ * returning undefined: every caller (portal, settings load, CLI) needs to tell
+ * the human what was wrong with what they typed.
+ */
+export function parseSource(source) {
+    const trimmed = source.trim();
+    if (!trimmed)
+        throw new Error("Package source is empty");
+    const { rest: withoutSubpath, subpath } = splitSubpath(trimmed);
+    const { rest: locator, ref } = splitRef(withoutSubpath);
+    if (locator.startsWith("github:")) {
+        const repo = stripGitSuffix(locator.slice("github:".length).replace(/^\/+/, ""));
+        if (!repo.includes("/")) {
+            throw new Error(`github: source must be owner/repo, got ${JSON.stringify(locator)}`);
+        }
+        return git(`https://github.com/${repo}.git`, ref, subpath);
+    }
+    if (locator.startsWith("git:")) {
+        const inner = locator.slice("git:".length);
+        if (isProtocolUrl(inner) || SCP_LIKE.test(inner))
+            return git(inner, ref, subpath);
+        // Shorthand: host/owner/repo — only meaningful with the git: prefix,
+        // since bare host/owner/repo is ambiguous with a relative path.
+        if (!inner.includes("/")) {
+            throw new Error(`git: source must include a path, got ${JSON.stringify(locator)}`);
+        }
+        return git(`https://${stripGitSuffix(inner)}.git`, ref, subpath);
+    }
+    if (isProtocolUrl(locator) || SCP_LIKE.test(locator))
+        return git(locator, ref, subpath);
+    if (isAbsolute(locator) || locator.startsWith("./") || locator.startsWith("../")) {
+        if (ref)
+            throw new Error("A local path source cannot carry an @ref");
+        if (subpath)
+            throw new Error("A local path source cannot carry a #subpath");
+        return { type: "local", path: resolve(locator) };
+    }
+    throw new Error(`Unrecognized package source ${JSON.stringify(source)}. ` +
+        "Use a git URL, github:owner/repo, git:host/owner/repo, or an absolute/relative path.");
+}
+function git(url, ref, subpath) {
+    return { type: "git", url, ...(ref ? { ref } : {}), ...(subpath ? { subpath } : {}) };
+}
+function isProtocolUrl(value) {
+    return PROTOCOL_PREFIXES.some((prefix) => value.startsWith(prefix));
+}
+function stripGitSuffix(value) {
+    return value.replace(/\.git$/, "").replace(/\/+$/, "");
+}
+function splitSubpath(source) {
+    const hash = source.indexOf("#");
+    if (hash === -1)
+        return { rest: source };
+    const subpath = source.slice(hash + 1).trim();
+    if (!subpath)
+        return { rest: source.slice(0, hash) };
+    assertSafeRelativePath(subpath, "#subpath");
+    return { rest: source.slice(0, hash), subpath };
+}
+/**
+ * Split a trailing `@ref`. The `@` in `git@github.com:owner/repo` is part of
+ * the authority, not a ref, so a candidate only counts when its suffix looks
+ * like a bare ref (no `/`, no `:`).
+ */
+function splitRef(source) {
+    const at = source.lastIndexOf("@");
+    if (at <= 0)
+        return { rest: source };
+    const candidate = source.slice(at + 1);
+    if (!candidate || candidate.includes("/") || candidate.includes(":"))
+        return { rest: source };
+    return { rest: source.slice(0, at), ref: candidate };
+}
+/** Reject traversal and absolute escapes in the parts that become paths. */
+function assertSafeRelativePath(value, label) {
+    if (isAbsolute(value) || value.split(/[\\/]/).some((segment) => segment === "..")) {
+        throw new Error(`${label} must be a relative path without '..': ${JSON.stringify(value)}`);
+    }
+}
+/**
+ * Identity of the package a source refers to — the key for deduplication and
+ * for letting a conversation's copy shadow the global one.
+ *
+ * Deliberate choices:
+ * - The ref is excluded: the same repo pinned to two refs in two scopes is one
+ *   package installed twice, and the narrower scope wins.
+ * - The subpath is included: two extensions living at different paths in one
+ *   monorepo are two packages.
+ * - Transport is excluded: `git@github.com:o/r`, `https://github.com/o/r.git`
+ *   and `ssh://git@github.com/o/r` all identify the same package, so mixing
+ *   SSH and HTTPS spellings across scopes still dedups.
+ */
+export function sourceIdentity(parsed) {
+    if (parsed.type === "local")
+        return `local:${parsed.path}`;
+    const repo = gitRepoPath(parsed.url);
+    return parsed.subpath ? `git:${repo}#${parsed.subpath}` : `git:${repo}`;
+}
+/**
+ * Transport-independent `<host>/<path>` of a git URL, lowercased host, no
+ * `.git` suffix, no credentials. It is the base of the on-disk clone layout,
+ * so it must stay free of anything that is not a safe path segment.
+ */
+export function gitRepoPath(url) {
+    let remainder = url;
+    for (const prefix of PROTOCOL_PREFIXES) {
+        if (remainder.startsWith(prefix)) {
+            remainder = remainder.slice(prefix.length);
+            break;
+        }
+    }
+    // Drop any credentials in the authority (`user:pass@host`, `git@host`).
+    const scpMatch = /^([^@/\s]+@)?([^:/\s]+)[:/](.+)$/.exec(remainder);
+    if (!scpMatch)
+        return sanitizeRepoPath(stripGitSuffix(remainder));
+    const host = (scpMatch[2] ?? "").toLowerCase();
+    const path = stripGitSuffix((scpMatch[3] ?? "").replace(/^\/+/, ""));
+    return sanitizeRepoPath(`${host}/${path}`);
+}
+/**
+ * `file://` URLs used in tests and local mirrors have no host, so the repo path
+ * is an absolute filesystem path. Keep every segment filesystem-safe and drop
+ * traversal, since this string becomes a directory under the state dir.
+ */
+function sanitizeRepoPath(value) {
+    const segments = value
+        .split(/[\\/]/)
+        .map((segment) => segment.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^\.+$/, ""))
+        .filter((segment) => segment.length > 0);
+    if (segments.length === 0)
+        throw new Error(`Cannot derive a package path from ${value}`);
+    return segments.join("/");
+}
+/**
+ * Canonical string form, used when writing settings so the stored value is
+ * stable regardless of how the human spelled it.
+ */
+export function formatSource(parsed) {
+    if (parsed.type === "local")
+        return parsed.path;
+    const ref = parsed.ref ? `@${parsed.ref}` : "";
+    const subpath = parsed.subpath ? `#${parsed.subpath}` : "";
+    return `${parsed.url}${ref}${subpath}`;
+}
+//# sourceMappingURL=source.js.map

package/dist/packages/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../src/packages/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGhD,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AACjF,MAAM,QAAQ,GAAG,qBAAqB,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QAC7B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1B,aAAa,CAAC,OAAO,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAEzD,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IAExD,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,GAAG,CAAC,sBAAsB,IAAI,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAClF,qEAAqE;QACrE,gEAAgE;QAChE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,GAAG,CAAC,WAAW,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAExF,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,IAAI,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACrE,IAAI,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC5E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI;QACvD,sFAAsF,CACzF,CAAC;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,GAAW,EAAE,GAAuB,EAAE,OAA2B;IAC5E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IACrD,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,MAAc;IAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9F,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AACvD,CAAC;AAED,4EAA4E;AAC5E,SAAS,sBAAsB,CAAC,KAAa,EAAE,KAAa;IAC1D,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0CAA0C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB;IACjD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,SAAS,GAAG,GAAG,CAAC;IACpB,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM;QACR,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,MAAM,QAAQ,GAAG,kCAAkC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,CAAC,QAAQ;QAAE,OAAO,gBAAgB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,gBAAgB,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,QAAQ,GAAG,KAAK;SACnB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;SAChF,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,OAAO,GAAG,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,OAAO,EAAE,CAAC;AACzC,CAAC","sourcesContent":["/**\n * The package source grammar: one place that turns a human-written source\n * string into a {@link ParsedSource}, and one place that decides when two\n * sources are the same package ({@link sourceIdentity}).\n *\n * Only git and local-path sources are implemented. The tagged union and the\n * identity function are the seams a future `npm:` source slots into: adding it\n * means a new arm here and a new materializer, with nothing downstream —\n * resolution, scope precedence, the portal — needing to know.\n *\n * Grammar:\n *\n *   <locator>[@<ref>][#<subpath>]\n *\n *   locator: https://…  http://…  ssh://…  git://…  file://…\n *            git@host:owner/repo\n *            git:<any of the above, or host/owner/repo shorthand>\n *            github:owner/repo\n *            /abs/path  ./rel/path        (local, used by reference)\n *\n * `@<ref>` is recognized only when what follows the last `@` contains no `/`\n * and no `:` — otherwise the `@` belongs to the URL's authority\n * (`git@github.com:…`). A consequence: refs containing a slash\n * (`release/1.0`) cannot be written in the string form; pin to a tag or a\n * commit sha instead. The admin portal takes the URL and the ref as separate\n * inputs and assembles a canonical string, so this only constrains\n * hand-edited settings.\n */\nimport { isAbsolute, resolve } from \"node:path\";\nimport type { PackageIdentity, ParsedSource } from \"./types.js\";\n\nconst PROTOCOL_PREFIXES = [\"https://\", \"http://\", \"ssh://\", \"git://\", \"file://\"];\nconst SCP_LIKE = /^[^@/\\s]+@[^:/\\s]+:/;\n\n/**\n * Whether a source string spells a git source (vs a local path) — the one\n * home of the prefix rule. Classification only; `parseSource` still owns\n * validation and error messages.\n */\nexport function isGitSourceString(source: string): boolean {\n  const locator = source.trim();\n  return (\n    locator.startsWith(\"github:\") ||\n    locator.startsWith(\"git:\") ||\n    isProtocolUrl(locator) ||\n    SCP_LIKE.test(locator)\n  );\n}\n\n/**\n * Parse a source string. Throws with a user-facing message rather than\n * returning undefined: every caller (portal, settings load, CLI) needs to tell\n * the human what was wrong with what they typed.\n */\nexport function parseSource(source: string): ParsedSource {\n  const trimmed = source.trim();\n  if (!trimmed) throw new Error(\"Package source is empty\");\n\n  const { rest: withoutSubpath, subpath } = splitSubpath(trimmed);\n  const { rest: locator, ref } = splitRef(withoutSubpath);\n\n  if (locator.startsWith(\"github:\")) {\n    const repo = stripGitSuffix(locator.slice(\"github:\".length).replace(/^\\/+/, \"\"));\n    if (!repo.includes(\"/\")) {\n      throw new Error(`github: source must be owner/repo, got ${JSON.stringify(locator)}`);\n    }\n    return git(`https://github.com/${repo}.git`, ref, subpath);\n  }\n\n  if (locator.startsWith(\"git:\")) {\n    const inner = locator.slice(\"git:\".length);\n    if (isProtocolUrl(inner) || SCP_LIKE.test(inner)) return git(inner, ref, subpath);\n    // Shorthand: host/owner/repo — only meaningful with the git: prefix,\n    // since bare host/owner/repo is ambiguous with a relative path.\n    if (!inner.includes(\"/\")) {\n      throw new Error(`git: source must include a path, got ${JSON.stringify(locator)}`);\n    }\n    return git(`https://${stripGitSuffix(inner)}.git`, ref, subpath);\n  }\n\n  if (isProtocolUrl(locator) || SCP_LIKE.test(locator)) return git(locator, ref, subpath);\n\n  if (isAbsolute(locator) || locator.startsWith(\"./\") || locator.startsWith(\"../\")) {\n    if (ref) throw new Error(\"A local path source cannot carry an @ref\");\n    if (subpath) throw new Error(\"A local path source cannot carry a #subpath\");\n    return { type: \"local\", path: resolve(locator) };\n  }\n\n  throw new Error(\n    `Unrecognized package source ${JSON.stringify(source)}. ` +\n      \"Use a git URL, github:owner/repo, git:host/owner/repo, or an absolute/relative path.\",\n  );\n}\n\nfunction git(url: string, ref: string | undefined, subpath: string | undefined): ParsedSource {\n  return { type: \"git\", url, ...(ref ? { ref } : {}), ...(subpath ? { subpath } : {}) };\n}\n\nfunction isProtocolUrl(value: string): boolean {\n  return PROTOCOL_PREFIXES.some((prefix) => value.startsWith(prefix));\n}\n\nfunction stripGitSuffix(value: string): string {\n  return value.replace(/\\.git$/, \"\").replace(/\\/+$/, \"\");\n}\n\nfunction splitSubpath(source: string): { rest: string; subpath?: string } {\n  const hash = source.indexOf(\"#\");\n  if (hash === -1) return { rest: source };\n  const subpath = source.slice(hash + 1).trim();\n  if (!subpath) return { rest: source.slice(0, hash) };\n  assertSafeRelativePath(subpath, \"#subpath\");\n  return { rest: source.slice(0, hash), subpath };\n}\n\n/**\n * Split a trailing `@ref`. The `@` in `git@github.com:owner/repo` is part of\n * the authority, not a ref, so a candidate only counts when its suffix looks\n * like a bare ref (no `/`, no `:`).\n */\nfunction splitRef(source: string): { rest: string; ref?: string } {\n  const at = source.lastIndexOf(\"@\");\n  if (at <= 0) return { rest: source };\n  const candidate = source.slice(at + 1);\n  if (!candidate || candidate.includes(\"/\") || candidate.includes(\":\")) return { rest: source };\n  return { rest: source.slice(0, at), ref: candidate };\n}\n\n/** Reject traversal and absolute escapes in the parts that become paths. */\nfunction assertSafeRelativePath(value: string, label: string): void {\n  if (isAbsolute(value) || value.split(/[\\\\/]/).some((segment) => segment === \"..\")) {\n    throw new Error(`${label} must be a relative path without '..': ${JSON.stringify(value)}`);\n  }\n}\n\n/**\n * Identity of the package a source refers to — the key for deduplication and\n * for letting a conversation's copy shadow the global one.\n *\n * Deliberate choices:\n * - The ref is excluded: the same repo pinned to two refs in two scopes is one\n *   package installed twice, and the narrower scope wins.\n * - The subpath is included: two extensions living at different paths in one\n *   monorepo are two packages.\n * - Transport is excluded: `git@github.com:o/r`, `https://github.com/o/r.git`\n *   and `ssh://git@github.com/o/r` all identify the same package, so mixing\n *   SSH and HTTPS spellings across scopes still dedups.\n */\nexport function sourceIdentity(parsed: ParsedSource): PackageIdentity {\n  if (parsed.type === \"local\") return `local:${parsed.path}`;\n  const repo = gitRepoPath(parsed.url);\n  return parsed.subpath ? `git:${repo}#${parsed.subpath}` : `git:${repo}`;\n}\n\n/**\n * Transport-independent `<host>/<path>` of a git URL, lowercased host, no\n * `.git` suffix, no credentials. It is the base of the on-disk clone layout,\n * so it must stay free of anything that is not a safe path segment.\n */\nexport function gitRepoPath(url: string): string {\n  let remainder = url;\n  for (const prefix of PROTOCOL_PREFIXES) {\n    if (remainder.startsWith(prefix)) {\n      remainder = remainder.slice(prefix.length);\n      break;\n    }\n  }\n  // Drop any credentials in the authority (`user:pass@host`, `git@host`).\n  const scpMatch = /^([^@/\\s]+@)?([^:/\\s]+)[:/](.+)$/.exec(remainder);\n  if (!scpMatch) return sanitizeRepoPath(stripGitSuffix(remainder));\n  const host = (scpMatch[2] ?? \"\").toLowerCase();\n  const path = stripGitSuffix((scpMatch[3] ?? \"\").replace(/^\\/+/, \"\"));\n  return sanitizeRepoPath(`${host}/${path}`);\n}\n\n/**\n * `file://` URLs used in tests and local mirrors have no host, so the repo path\n * is an absolute filesystem path. Keep every segment filesystem-safe and drop\n * traversal, since this string becomes a directory under the state dir.\n */\nfunction sanitizeRepoPath(value: string): string {\n  const segments = value\n    .split(/[\\\\/]/)\n    .map((segment) => segment.replace(/[^A-Za-z0-9._-]+/g, \"-\").replace(/^\\.+$/, \"\"))\n    .filter((segment) => segment.length > 0);\n  if (segments.length === 0) throw new Error(`Cannot derive a package path from ${value}`);\n  return segments.join(\"/\");\n}\n\n/**\n * Canonical string form, used when writing settings so the stored value is\n * stable regardless of how the human spelled it.\n */\nexport function formatSource(parsed: ParsedSource): string {\n  if (parsed.type === \"local\") return parsed.path;\n  const ref = parsed.ref ? `@${parsed.ref}` : \"\";\n  const subpath = parsed.subpath ? `#${parsed.subpath}` : \"\";\n  return `${parsed.url}${ref}${subpath}`;\n}\n"]}

package/dist/packages/types.d.ts

@@ -0,0 +1,104 @@
+/**
+ * A package source as written by a human: the string stored in `packages[]`
+ * in global or conversation settings, and the string typed into the admin
+ * portal. Parsing it is {@link parseSource}'s job.
+ */
+import type { Office } from "../office/types.js";
+import type { GlobalRunnerCacheControl, OfficeAddress, RunnerCacheControl } from "../types.js";
+export type PackageSourceString = string;
+/** Scope a package belongs to. `global` spans every conversation. */
+export type PackageScope = "global" | "conversation";
+/**
+ * A git source. `ref` is a tag, branch, or commit — absent means "whatever the
+ * remote's default branch points at now", which only moves on an explicit
+ * update. `subpath` addresses a package inside a larger repository.
+ */
+interface GitSource {
+    type: "git";
+    /** Clone URL handed to `git`, after shorthand expansion. */
+    url: string;
+    ref?: string;
+    subpath?: string;
+}
+/**
+ * A directory on the mikan host, used by reference — never copied. Editing the
+ * directory is picked up by the next harness instance, which is what makes
+ * host-side development of an extension bearable.
+ */
+interface LocalSource {
+    type: "local";
+    path: string;
+}
+export type ParsedSource = GitSource | LocalSource;
+/**
+ * Stable identity of a package, independent of version and of the scope it is
+ * installed in. Two sources with the same identity are the same package, so
+ * the conversation scope's copy can shadow the global one.
+ *
+ * Deliberately excludes the ref: `…/repo@v1` in global and `…/repo@v2` in a
+ * conversation are one package pinned two ways, and the conversation wins.
+ */
+export type PackageIdentity = string;
+/** Where a materialized package's files live, plus how it got there. */
+export interface MaterializedPackage {
+    source: PackageSourceString;
+    parsed: ParsedSource;
+    identity: PackageIdentity;
+    /**
+     * Directory holding the package's files. For git this is inside the state
+     * dir (a clone, plus `subpath`); for local it is the referenced path itself.
+     */
+    dir: string;
+    scope: PackageScope;
+}
+/** A source that failed to materialize, reported back to whoever asked. */
+export interface PackageError {
+    source: PackageSourceString;
+    message: string;
+}
+export interface ResolvedPackages {
+    packages: MaterializedPackage[];
+    extensionDirs: string[];
+    extensionRoots: string[];
+    skillDirs: PackageSkillDir[];
+    errors: PackageError[];
+}
+export interface PackageSkillDir {
+    slug: string;
+    dir: string;
+}
+export interface ResolvePackagesOptions {
+    /** Office whose packages resolve; identity and state-dir keys derive from it. */
+    office: Office;
+    fetchMissing?: boolean;
+}
+export type MaterializeMode = "offline" | "fetch" | "refresh";
+export interface MaterializeOptions {
+    scope: PackageScope;
+    address?: OfficeAddress;
+    stateDir: string;
+    mode?: MaterializeMode;
+}
+export interface PackageStatus {
+    source: string;
+    scope: PackageScope;
+    ready: boolean;
+    error?: string;
+    dir?: string;
+    shadowed?: boolean;
+    extensions: string[];
+    skills: string[];
+}
+export interface PackageInventory {
+    global: PackageStatus[];
+    conversation: PackageStatus[];
+}
+export interface PackageAdminContext extends ResolvePackagesOptions {
+    runtime?: RunnerCacheControl & GlobalRunnerCacheControl;
+}
+export interface PackageWriteResult {
+    source: string;
+    dir: string;
+}
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/packages/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/packages/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE/F,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEzC,qEAAqE;AACrE,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,cAAc,CAAC;AAErD;;;;GAIG;AACH,UAAU,SAAS;IACjB,IAAI,EAAE,KAAK,CAAC;IACZ,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,UAAU,WAAW;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,sBAAsB;IACrC,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,YAAY,EAAE,aAAa,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAoB,SAAQ,sBAAsB;IACjE,OAAO,CAAC,EAAE,kBAAkB,GAAG,wBAAwB,CAAC;CACzD;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb"}

package/dist/packages/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/packages/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/packages/types.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * A package source as written by a human: the string stored in `packages[]`\n * in global or conversation settings, and the string typed into the admin\n * portal. Parsing it is {@link parseSource}'s job.\n */\nimport type { Office } from \"../office/types.js\";\nimport type { GlobalRunnerCacheControl, OfficeAddress, RunnerCacheControl } from \"../types.js\";\n\nexport type PackageSourceString = string;\n\n/** Scope a package belongs to. `global` spans every conversation. */\nexport type PackageScope = \"global\" | \"conversation\";\n\n/**\n * A git source. `ref` is a tag, branch, or commit — absent means \"whatever the\n * remote's default branch points at now\", which only moves on an explicit\n * update. `subpath` addresses a package inside a larger repository.\n */\ninterface GitSource {\n  type: \"git\";\n  /** Clone URL handed to `git`, after shorthand expansion. */\n  url: string;\n  ref?: string;\n  subpath?: string;\n}\n\n/**\n * A directory on the mikan host, used by reference — never copied. Editing the\n * directory is picked up by the next harness instance, which is what makes\n * host-side development of an extension bearable.\n */\ninterface LocalSource {\n  type: \"local\";\n  path: string;\n}\n\nexport type ParsedSource = GitSource | LocalSource;\n\n/**\n * Stable identity of a package, independent of version and of the scope it is\n * installed in. Two sources with the same identity are the same package, so\n * the conversation scope's copy can shadow the global one.\n *\n * Deliberately excludes the ref: `…/repo@v1` in global and `…/repo@v2` in a\n * conversation are one package pinned two ways, and the conversation wins.\n */\nexport type PackageIdentity = string;\n\n/** Where a materialized package's files live, plus how it got there. */\nexport interface MaterializedPackage {\n  source: PackageSourceString;\n  parsed: ParsedSource;\n  identity: PackageIdentity;\n  /**\n   * Directory holding the package's files. For git this is inside the state\n   * dir (a clone, plus `subpath`); for local it is the referenced path itself.\n   */\n  dir: string;\n  scope: PackageScope;\n}\n\n/** A source that failed to materialize, reported back to whoever asked. */\nexport interface PackageError {\n  source: PackageSourceString;\n  message: string;\n}\n\nexport interface ResolvedPackages {\n  packages: MaterializedPackage[];\n  extensionDirs: string[];\n  extensionRoots: string[];\n  skillDirs: PackageSkillDir[];\n  errors: PackageError[];\n}\n\nexport interface PackageSkillDir {\n  slug: string;\n  dir: string;\n}\n\nexport interface ResolvePackagesOptions {\n  /** Office whose packages resolve; identity and state-dir keys derive from it. */\n  office: Office;\n  fetchMissing?: boolean;\n}\n\nexport type MaterializeMode = \"offline\" | \"fetch\" | \"refresh\";\n\nexport interface MaterializeOptions {\n  scope: PackageScope;\n  address?: OfficeAddress;\n  stateDir: string;\n  mode?: MaterializeMode;\n}\n\nexport interface PackageStatus {\n  source: string;\n  scope: PackageScope;\n  ready: boolean;\n  error?: string;\n  dir?: string;\n  shadowed?: boolean;\n  extensions: string[];\n  skills: string[];\n}\n\nexport interface PackageInventory {\n  global: PackageStatus[];\n  conversation: PackageStatus[];\n}\n\nexport interface PackageAdminContext extends ResolvePackagesOptions {\n  runtime?: RunnerCacheControl & GlobalRunnerCacheControl;\n}\n\nexport interface PackageWriteResult {\n  source: string;\n  dir: string;\n}\n"]}

package/dist/provisioner.d.ts

@@ -1,14 +1,26 @@
 export type { ContainerMount, DockerContainerManagerOptions, ProvisionOptions, ResourceLimits, SandboxLimitStatus, } from "./types.js";
 import type { DockerContainerManagerOptions, ProvisionOptions, ResourceLimits, SandboxLimitStatus } from "./types.js";
+/**
+ * Rewrites one docker bind spec (`src:dst[:ro]`) from the legacy raw-id
+ * layout to the office-key layout. Returns the spec unchanged when nothing in
+ * it needs translation; a container whose binds are all unchanged is already
+ * on the current layout.
+ */
+export type ContainerBindTranslator = (bindSpec: string) => string;
 export declare class DockerContainerManager {
     private readonly image;
     private state;
     private inflight;
+    /** Active layout migration; unset means no translation ever applies. */
+    private bindTranslator?;
+    private layoutMigrations;
     private static readonly MANAGED_LABEL;
     private static readonly IMAGE_MODE_LABEL;
     private static readonly VAULT_ID_LABEL_KEY;
     private static readonly CONVERSATION_ID_LABEL_KEY;
     private static readonly MOUNT_SIGNATURE_LABEL_KEY;
+    private static readonly MIGRATE_IMAGE_PREFIX;
+    private static readonly MIGRATE_BINDS_LABEL_KEY;
     private readonly limits?;
     private readonly boostLimits?;
     private readonly boostedKeys;
@@ -28,6 +40,60 @@ export declare class DockerContainerManager {
     stop(containerKey: string): Promise<void>;
     remove(containerKey: string): Promise<void>;
     stopIdle(maxIdleMs: number): Promise<void>;
+    /**
+     * Force-remove every managed container belonging to the given conversation
+     * ids. The office layout migration renames the host directories a
+     * container's workspace mount points at, so a surviving container would keep
+     * writing through stale mounts while the runtime works in the new location.
+     */
+    removeContainersForConversations(conversationIds: ReadonlySet<string>): Promise<void>;
+    /**
+     * Arm the office-layout container migration. Containers whose binds still
+     * reference legacy raw-id paths are moved to the office-key layout without
+     * losing their writable layer: commit → remove → create with translated
+     * binds, preserving everything installed inside. Idempotent per container
+     * and resumable — the pre-removal binds ride on the snapshot image label,
+     * so a crash between commit and create resumes from the snapshot.
+     */
+    armContainerLayoutMigration(translator: ContainerBindTranslator): void;
+    /**
+     * Sweep every managed container through the layout migration, serially and
+     * with a small gap, so the one-time cost never lands on the boot path or on
+     * a message. Safe to fire-and-forget; each unit is idempotent.
+     */
+    sweepContainerLayoutMigration(delayMs?: number): Promise<void>;
+    /** Move one container to the office-key layout; no-op when already there. */
+    private migrateContainerLayout;
+    private migrateContainerLayoutInner;
+    /**
+     * Create `containerName` from its layout snapshot with `bindSpecs`,
+     * restoring the managed labels and recomputing the mount signature.
+     * `create`, not `run`: idle containers stay stopped exactly as they were;
+     * callers that need the container running start it themselves.
+     */
+    private createContainerFromSnapshot;
+    /**
+     * Recreate a drifted container with the desired mounts while keeping its
+     * writable layer: commit — the new binds ride the snapshot label, so a
+     * crash at any point resumes through the layout-migration path — then
+     * remove, create from the snapshot, and start. Committing replaces any
+     * older snapshot tag for this container; the untagged predecessor is
+     * removed once the new container is up.
+     */
+    private recreateContainerPreservingContents;
+    /** Resolved image id for a reference, or undefined when it does not exist. */
+    private readImageId;
+    /** Binds recorded on a snapshot image, or undefined when no snapshot exists. */
+    private readMigrateImageBinds;
+    private readImageLabel;
+    /**
+     * Delete a container's layout snapshot after an intentional removal, so a
+     * missing container plus a surviving snapshot can only mean a crash in the
+     * middle of the layout migration (the resume discriminator).
+     */
+    private removeMigrateSnapshot;
+    private listMigrateSnapshotContainerNames;
+    private removeDanglingMigrateImages;
     reconcile(): Promise<void>;
     private setState;
     private getContainerName;

package/dist/provisioner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../src/provisioner.ts"],"names":[],"mappings":"AAmCA,YAAY,EACV,cAAc,EACd,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAEV,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,qBAAa,sBAAsB;IAgB/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAfxB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAwB;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAE5E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAE7C,YACmB,KAAK,EAAE,MAAM,EAC9B,OAAO,GAAE,6BAAkC,EAK5C;IAED,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM5C;IAED,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjD;IAED,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/C;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CASrF;YAEa,cAAc;IAkCtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAY7D;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQzF;IAED,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAGvD;IAED,gBAAgB,IAAI,cAAc,GAAG,SAAS,CAE7C;IAED,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3C;IAEK,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc9C;IAEK,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhD;IAEK,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/C;IAEK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CA0C/B;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;YAIJ,YAAY;IAkD1B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;YAaX,mBAAmB;YA2BnB,eAAe;YAcf,iBAAiB;IAS/B,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;YAQH,sBAAsB;IAgBpC,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,sBAAsB;YAYhB,iBAAiB;YAqBjB,mBAAmB;YAWnB,aAAa;YAwBb,aAAa;YAeb,yBAAyB;YAsBzB,0BAA0B;IAoBxC,OAAO,CAAC,cAAc;YAOR,uBAAuB;IA4BrC,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,6BAA6B;YAOvB,oBAAoB;YAapB,qBAAqB;CAOpC"}
+{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../src/provisioner.ts"],"names":[],"mappings":"AAqCA,YAAY,EACV,cAAc,EACd,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAEV,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;AAcnE,qBAAa,sBAAsB;IAqB/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IApBxB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,wEAAwE;IACxE,OAAO,CAAC,cAAc,CAAC,CAA0B;IACjD,OAAO,CAAC,gBAAgB,CAAoC;IAC5D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAwB;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAmB;IAC/D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAyB;IAExE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAE7C,YACmB,KAAK,EAAE,MAAM,EAC9B,OAAO,GAAE,6BAAkC,EAK5C;IAED,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C;IAED,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjD;IAED,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/C;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CASrF;YAEa,cAAc;IA2CtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAY7D;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQzF;IAED,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAGvD;IAED,gBAAgB,IAAI,cAAc,GAAG,SAAS,CAE7C;IAED,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3C;IAEK,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc9C;IAEK,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBhD;IAEK,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/C;IAED;;;;;OAKG;IACG,gCAAgC,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAc1F;IAED;;;;;;;OAOG;IACH,2BAA2B,CAAC,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAErE;IAED;;;;OAIG;IACG,6BAA6B,CAAC,OAAO,SAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BjE;IAED,6EAA6E;IAC7E,OAAO,CAAC,sBAAsB;YAYhB,2BAA2B;IAoCzC;;;;;OAKG;YACW,2BAA2B;IAwDzC;;;;;;;OAOG;YACW,mCAAmC;IA+BjD,8EAA8E;YAChE,WAAW;IAUzB,gFAAgF;YAClE,qBAAqB;YAarB,cAAc;IAc5B;;;;OAIG;YACW,qBAAqB;YAWrB,iCAAiC;YAcjC,2BAA2B;IAmCnC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CA0C/B;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;YAOJ,YAAY;IAkD1B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;YAaX,mBAAmB;YA2BnB,eAAe;YAcf,iBAAiB;IAS/B,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;YAQH,sBAAsB;IAgBpC,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,sBAAsB;YAoBhB,iBAAiB;YAqBjB,mBAAmB;YAWnB,aAAa;YAwBb,aAAa;YAeb,yBAAyB;YAsBzB,0BAA0B;IAoBxC,OAAO,CAAC,cAAc;YAOR,uBAAuB;IA4BrC,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,6BAA6B;YAOvB,oBAAoB;YAapB,qBAAqB;CAOpC"}