@ken-jo/agent-connector 0.3.1 → 0.4.1

package/dist/chunk-2AVLX7GH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/runtime/telemetry-accessor.ts","../src/telemetry/measure.ts","../src/runtime/hook-entrypoint.ts"],"sourcesContent":["/**\n * runtime/telemetry-accessor — build the handler-facing {@link TelemetryAccessor}.\n *\n * Every runtime entrypoint (hook / statusline / action) stamps `ctx.telemetry`\n * (or `evt.telemetry`) with the accessor built here so a connector handler can\n * read ITS OWN recorded usage on demand (`await ctx.telemetry?.()`), without the\n * handler reaching into the telemetry store directly.\n *\n * The accessor is LAZY (it opens the store only when called) and DEFENSIVE:\n *   - AGENT_CONNECTOR_TELEMETRY=0 → resolves zeros without touching disk;\n *   - any read error → resolves zeros (NEVER throws into a handler — the hook\n *     runtime is fail-open, the statusline fail-safe, and even the action\n *     surface must not have a usage read crash an otherwise-fine run).\n *\n * COST: each call reads the connector's telemetry file in full (the NDJSON\n * store has no since/limit bound) and linear-scans it. Cheap for normal stores,\n * but a handler on a HOT path (e.g. a status line rendered every refresh) should\n * call it sparingly and cache the result rather than invoking it per render.\n */\n\nimport type { TelemetryAccessor, TelemetryUsageSummary } from \"../core/types.js\";\nimport { openStore } from \"../telemetry/store.js\";\n\n/** The empty summary returned when telemetry is off or a read fails. */\nconst ZERO: TelemetryUsageSummary = {\n  inputTokens: 0,\n  outputTokens: 0,\n  totalTokens: 0,\n  calls: 0,\n};\n\n/**\n * Build a {@link TelemetryAccessor} bound to `connectorId`. The returned async\n * function sums every stored row's inputTokens/outputTokens for the connector\n * and counts the rows (`calls`). Honors the AGENT_CONNECTOR_TELEMETRY=0 kill\n * switch (zeros, no disk touch) and swallows any error (zeros) — it never throws.\n */\nexport function buildTelemetryAccessor(connectorId: string): TelemetryAccessor {\n  return async (): Promise<TelemetryUsageSummary> => {\n    if (process.env.AGENT_CONNECTOR_TELEMETRY === \"0\") return { ...ZERO };\n    try {\n      const store = openStore({});\n      try {\n        let inputTokens = 0;\n        let outputTokens = 0;\n        let calls = 0;\n        // COERCE each addend to a finite number: query() tolerates malformed\n        // LINES but does not validate field shapes, so a legacy/hand-edited row\n        // with a missing (→ NaN) or string (→ concat) token field must not\n        // poison the summary's numeric contract. A non-finite token reads as 0.\n        for (const row of store.query({ connectorId })) {\n          inputTokens += Number.isFinite(row.inputTokens) ? row.inputTokens : 0;\n          outputTokens += Number.isFinite(row.outputTokens) ? row.outputTokens : 0;\n          calls += 1;\n        }\n        return {\n          inputTokens,\n          outputTokens,\n          totalTokens: inputTokens + outputTokens,\n          calls,\n        };\n      } finally {\n        store.close();\n      }\n    } catch {\n      // Never throw into a handler — a usage read failure resolves to zeros.\n      return { ...ZERO };\n    }\n  };\n}\n","/**\n * telemetry/measure — pure measurement helpers over a single MCP tool call.\n *\n * The framework tokenizes its OWN bytes: the tool-call arguments going in, the\n * tool result coming out, and the fixed tool-definition schemas. These helpers\n * turn those into {@link TokenCount}s using the default {@link Tokenizer}.\n *\n * Honesty rules:\n *   • Binary modalities (image/audio/resource blobs) are NOT tokenized — base64\n *     would massively over-count. Each gets a flat per-modality estimate, and\n *     because that estimate is itself an approximation the combined confidence\n *     is pulled down to at least \"tokenizer-approx\".\n *   • When combining several counts, the reported confidence is the WORST\n *     (least-confident) of the inputs — never report \"exact\" for a mixed bag.\n *\n * Everything here is pure: no IO, no mutation of inputs.\n */\n\nimport { getTokenizer } from \"./tokenizer.js\";\nimport { worstConfidence } from \"./types.js\";\nimport type {\n  ConfidenceSource,\n  ModelFamily,\n  TokenCount,\n  Tokenizer,\n} from \"./types.js\";\n\n/** Per-call measurement: tokens in, tokens out, and combined confidence. */\nexport interface ToolCallMeasurement {\n  inputTokens: number;\n  outputTokens: number;\n  source: ConfidenceSource;\n}\n\n/**\n * Flat token estimates for non-text content blocks. These mirror common host\n * accounting (an image tile is roughly ~85 tokens at low detail); they are\n * deliberately coarse — we never tokenize the underlying base64 payload.\n */\nconst MODALITY_ESTIMATE: Record<string, number> = {\n  image: 85,\n  audio: 85,\n  resource: 85,\n};\n/** Fallback estimate for an unknown non-text block type. */\nconst UNKNOWN_BLOCK_ESTIMATE = 85;\n\n// Confidence ordering + the worst-of comparison live in ./types (the single\n// source of truth, imported as `worstConfidence` above). Re-exported here so\n// callers that already import `worstConfidence` from this module keep working\n// as a new ConfidenceSource value (e.g. tokenizer-calibrated) slots into the\n// shared ordering.\nexport { worstConfidence };\n\n/** Reduce a list of sources to the single worst (least-confident) one. */\nfunction combineSources(sources: readonly ConfidenceSource[]): ConfidenceSource {\n  // Default to the most-confident floor so an empty list combines to the only\n  // other source it is paired with; in practice callers always pass ≥1 source.\n  let worst: ConfidenceSource = \"host-native\";\n  for (const s of sources) worst = worstConfidence(worst, s);\n  return worst;\n}\n\n// ── Structural shapes we read from a tool result (kept local + narrow) ───────\n\n/** A text content block: `{ type: \"text\", text: \"...\" }`. */\ninterface TextBlock {\n  type: \"text\";\n  text?: unknown;\n}\n/** Any content block; only text blocks expose a `text` field we tokenize. */\ninterface ContentBlock {\n  type?: unknown;\n  text?: unknown;\n}\n/** The portion of an MCP tool result we measure. */\ninterface ToolResultLike {\n  content?: unknown;\n  structuredContent?: unknown;\n}\n\nfunction isObject(v: unknown): v is Record<string, unknown> {\n  return typeof v === \"object\" && v !== null;\n}\n\nfunction isTextBlock(block: ContentBlock): block is TextBlock {\n  return block.type === \"text\";\n}\n\n/**\n * Measure one tool call.\n *\n * Input  = canonical JSON of `args`.\n * Output = tokens over the TEXTUAL parts of `result`:\n *   • If `result.content` is an array of blocks, text blocks are tokenized via\n *     their `text` field and non-text blocks add a flat per-modality estimate\n *     (no base64 tokenization).\n *   • `result.structuredContent`, when present, is tokenized as canonical JSON.\n *   • Anything else (string / arbitrary object) is tokenized as canonical JSON.\n *\n * The reported `source` is the worst of the input and output sources.\n */\nexport function measureToolCall(\n  args: unknown,\n  result: unknown,\n  family: ModelFamily,\n  tok: Tokenizer = getTokenizer(),\n): ToolCallMeasurement {\n  const input = tok.countValue(args, family);\n  const output = measureResult(result, family, tok);\n  return {\n    inputTokens: input.tokens,\n    outputTokens: output.tokens,\n    source: worstConfidence(input.source, output.source),\n  };\n}\n\n/** Tokenize the textual + structured parts of a tool result. */\nfunction measureResult(\n  result: unknown,\n  family: ModelFamily,\n  tok: Tokenizer,\n): TokenCount {\n  if (!isObject(result)) {\n    // Plain string or scalar result — count its canonical form directly.\n    return tok.countValue(result, family);\n  }\n\n  const res = result as ToolResultLike;\n  const sources: ConfidenceSource[] = [];\n  let tokens = 0;\n\n  if (Array.isArray(res.content)) {\n    for (const raw of res.content) {\n      if (!isObject(raw)) continue;\n      const block = raw as ContentBlock;\n      if (isTextBlock(block)) {\n        const text = typeof block.text === \"string\" ? block.text : \"\";\n        const c = tok.count(text, family);\n        tokens += c.tokens;\n        sources.push(c.source);\n      } else {\n        // image / audio / resource / unknown → flat estimate, no base64 BPE.\n        const key = typeof block.type === \"string\" ? block.type : \"\";\n        tokens += MODALITY_ESTIMATE[key] ?? UNKNOWN_BLOCK_ESTIMATE;\n        // A flat estimate is an approximation, never \"exact\".\n        sources.push(\"tokenizer-approx\");\n      }\n    }\n  } else if (res.content !== undefined) {\n    // content present but not an array (e.g. a bare string) → count it whole.\n    const c = tok.countValue(res.content, family);\n    tokens += c.tokens;\n    sources.push(c.source);\n  }\n\n  if (res.structuredContent !== undefined) {\n    const c = tok.countValue(res.structuredContent, family);\n    tokens += c.tokens;\n    sources.push(c.source);\n  }\n\n  // Nothing measurable found → count the whole object as a fallback so we never\n  // silently report zero for a non-empty result.\n  if (sources.length === 0) {\n    return tok.countValue(result, family);\n  }\n\n  return { tokens, source: combineSources(sources) };\n}\n\n/**\n * Measure the fixed tool-definition overhead: tokenize the JSON of the entire\n * `tools/list` array once. `tools` is the raw array of tool descriptors as the\n * server advertises them (shape is host/SDK-specific, so it is treated as\n * opaque JSON here).\n */\nexport function measureToolDefs(\n  tools: readonly unknown[],\n  family: ModelFamily,\n  tok: Tokenizer = getTokenizer(),\n): TokenCount {\n  return tok.countValue(tools, family);\n}\n\n/**\n * Measure one RUNTIME hook dispatch (the new `hook` developer-axis surface).\n *\n * Input  = canonical JSON of the inbound normalized event payload the handler\n *          reads (the host-provided fields: toolInput / prompt / raw / etc.).\n * Output = canonical JSON of what the handler RETURNS that becomes context or a\n *          decision the host consumes (additionalContext / updatedInput / reason\n *          and the rest of the normalized {@link HookResponse}).\n *\n * Uses the SAME tokenizer + worst-of confidence combination as the proxy. Pure:\n * no IO, no mutation. The two values are tokenized whole (a hook payload has no\n * binary content blocks to special-case, unlike a tool result).\n */\nexport function measureHook(\n  eventPayload: unknown,\n  handlerReturn: unknown,\n  family: ModelFamily,\n  tok: Tokenizer = getTokenizer(),\n): ToolCallMeasurement {\n  const input = tok.countValue(eventPayload, family);\n  const output = tok.countValue(handlerReturn, family);\n  return {\n    inputTokens: input.tokens,\n    outputTokens: output.tokens,\n    source: worstConfidence(input.source, output.source),\n  };\n}\n","/**\n * runtime/hook-entrypoint — the universal json-stdio hook dispatcher.\n *\n * Every json-stdio host points its hook config at the single stable home binary\n * (`<homeBin> hook <platformId> <event> --connector <id>`, built by\n * core/spawn.buildHomeBinHookCommand). The CLI reads stdin and calls\n * {@link runHook} with the parsed flags + the raw stdin string. This module:\n *\n *   1. Loads the registered connector (live handlers) and the host adapter.\n *   2. Parses the host's stdin payload into a normalized event via the adapter.\n *   3. Finds the connector's handler for the event, honoring the tool matcher.\n *   4. Runs the handler, normalizes its return, and formats the adapter's native\n *      reply.\n *\n * Fail-open is the safety contract: ANY error degrades to exit 0 (\"allow\") so a\n * framework or handler bug can never wedge a host's tool call — EXCEPT when the\n * event is PreToolUse or PermissionRequest and the handler explicitly denied,\n * in which case the deny (a deliberate security decision) is preserved rather\n * than swallowed.\n */\n\nimport type {\n  HookEventName,\n  HookResponse,\n  NativeHookDef,\n  NativeHookEvent,\n  PlatformId,\n  ResolvedConnector,\n} from \"../core/types.js\";\nimport { log } from \"../core/logger.js\";\nimport {\n  loadRegisteredConnector,\n  readRegisteredMeta,\n} from \"../core/load-connector.js\";\nimport { loadAdapter, REGISTERED_PLATFORM_IDS } from \"../adapters/registry.js\";\nimport { buildTelemetryAccessor } from \"./telemetry-accessor.js\";\nimport type { NormalizedEvent } from \"../adapters/spi.js\";\nimport { projectIdentity } from \"../core/paths.js\";\nimport { measureHook } from \"../telemetry/measure.js\";\nimport { openStore, newRecordId } from \"../telemetry/store.js\";\nimport { getTokenizer, inferModelFamily } from \"../telemetry/tokenizer.js\";\n\n/** Flags + stdin the CLI hands to {@link runHook}. */\nexport interface RunHookOptions {\n  /** Host platform id from the hook command (`hook <platformId> ...`). */\n  platformId: string;\n  /** Canonical lifecycle event name from the hook command. */\n  event: HookEventName;\n  /** Connector id from `--connector <id>`. */\n  connectorId: string;\n  /** Raw stdin payload (host-native JSON). Empty string is tolerated → `{}`. */\n  stdin: string;\n}\n\n/** Process-level result the CLI translates into exit code + stdout/stderr. */\nexport interface RunHookResult {\n  exitCode: number;\n  stdout?: string;\n  stderr?: string;\n}\n\n/** A pass-through \"allow\" reply with exit 0 and no payload. */\nconst ALLOW: RunHookResult = { exitCode: 0 };\n\n/**\n * The string a connector matcher filters on, when the event carries one:\n * tool events (PreToolUse / PostToolUse / PermissionRequest /\n * PostToolUseFailure) expose `toolName`; subagent events expose `agentType`.\n * Returns undefined when the event has neither (no filtering) — including a\n * SubagentStop arriving WITHOUT agent_type, which some hosts fail to populate;\n * filtering out such an event would silently drop a real stop, so we run the\n * handler instead (fail-open).\n */\nexport function eventMatcherSubject(evt: NormalizedEvent): string | undefined {\n  const name = (evt as { toolName?: unknown }).toolName;\n  if (typeof name === \"string\") return name;\n  const agentType = (evt as { agentType?: unknown }).agentType;\n  if (typeof agentType === \"string\") return agentType;\n  return undefined;\n}\n\n/**\n * Tolerantly parse the host's stdin payload. Empty / whitespace-only input is a\n * legitimate \"no payload\" signal from some hosts and resolves to `{}`. Malformed\n * JSON also degrades to `{}` rather than throwing — fail-open is the contract.\n */\nfunction parseStdin(stdin: string): unknown {\n  const trimmed = stdin.trim();\n  if (trimmed === \"\") return {};\n  try {\n    return JSON.parse(trimmed);\n  } catch {\n    return {};\n  }\n}\n\n/**\n * Compile the connector's matcher (a regex string) for a tool event. A missing\n * or empty matcher matches everything (returns null → no filtering). An invalid\n * regex degrades to \"match everything\" so a typo never blocks tool calls.\n */\nexport function compileMatcher(matcher: string | undefined): RegExp | null {\n  if (!matcher || matcher === \"\") return null;\n  try {\n    return new RegExp(matcher);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Normalize a handler return into a concrete HookResponse. A void/non-object\n * return becomes `{}` — NO decision — which every adapter formats as\n * pass-through allow (`response.decision ?? \"allow\"`). Deliberately NOT\n * `{decision:\"allow\"}`: on PermissionRequest an explicit \"allow\" is an ACTIVE\n * grant that suppresses the host's permission dialog, and a handler that\n * returns nothing must fall through to the dialog, never silently grant.\n */\nfunction normalizeResponse(value: HookResponse | void): HookResponse {\n  if (value == null || typeof value !== \"object\") return {};\n  return value;\n}\n\n/**\n * Resolve the host platform to stamp on a hook telemetry row. Mirrors the serve\n * `--host` plumbing: the install-target platform id is baked into the hook\n * command (`hook <platformId> <event> …`) so `opts.platformId` is authoritative,\n * but an explicit env override (AGENT_CONNECTOR_HOST) wins when it names a known\n * platform. Falls back to the event's adapter-stamped hostPlatform, then\n * \"unknown\" — never throws.\n */\nfunction resolveHookHostPlatform(\n  platformId: string,\n  evt: NormalizedEvent | NativeHookEvent,\n): PlatformId {\n  const override = process.env.AGENT_CONNECTOR_HOST;\n  if (\n    override !== undefined &&\n    REGISTERED_PLATFORM_IDS.has(override as PlatformId)\n  ) {\n    return override as PlatformId;\n  }\n  if (REGISTERED_PLATFORM_IDS.has(platformId as PlatformId)) {\n    return platformId as PlatformId;\n  }\n  const fromEvent = (evt as { hostPlatform?: unknown }).hostPlatform;\n  if (\n    typeof fromEvent === \"string\" &&\n    REGISTERED_PLATFORM_IDS.has(fromEvent as PlatformId)\n  ) {\n    return fromEvent as PlatformId;\n  }\n  return \"unknown\";\n}\n\n/**\n * Record one RUNTIME hook dispatch as a `hook` developer-axis telemetry row.\n *\n * input  = the inbound event payload the handler reads (normalized event, or\n *          the {@link NativeHookEvent} envelope for native passthrough hooks);\n * output = what the handler returned (a normalized {@link HookResponse}, or the\n *          verbatim native reply object). Tokenized with the SAME tokenizer the\n *          proxy uses. For a native hook `opts.event` is the host-native name.\n *\n * MUST be fail-open (the hook runtime is fail-open by contract): any error here\n * is swallowed so a measurement bug can NEVER break a host's hook. Honors the\n * AGENT_CONNECTOR_TELEMETRY=0 kill switch (skips entirely; the store's append is\n * already a no-op under it, but we also skip the tokenize work).\n */\nfunction recordHookTelemetry(\n  opts: { platformId: string; event: string; connectorId: string },\n  connector: ResolvedConnector,\n  evt: NormalizedEvent | NativeHookEvent,\n  response: unknown,\n): void {\n  if (process.env.AGENT_CONNECTOR_TELEMETRY === \"0\") return;\n  try {\n    const family = inferModelFamily(\"\", connector.telemetry.modelFamilyHint);\n    const measurement = measureHook(evt, response, family, getTokenizer());\n\n    const sessionId =\n      typeof (evt as { sessionId?: unknown }).sessionId === \"string\"\n        ? ((evt as { sessionId: string }).sessionId)\n        : \"\";\n    const evtProjectDir = (evt as { projectDir?: unknown }).projectDir;\n    const projectDir =\n      typeof evtProjectDir === \"string\" && evtProjectDir !== \"\"\n        ? evtProjectDir\n        : process.cwd();\n    const id = projectIdentity(projectDir);\n\n    const store = openStore({});\n    try {\n      store.append({\n        id: newRecordId(0),\n        ts: Date.now(),\n        connectorId: opts.connectorId,\n        toolName: opts.event, // for a hook row the per-item name IS the event\n        scope: \"hook\",\n        surfaceKind: \"hook\",\n        hostPlatform: resolveHookHostPlatform(opts.platformId, evt),\n        sessionId,\n        projectKey: id.key,\n        projectDir: id.dir,\n        inputTokens: measurement.inputTokens,\n        outputTokens: measurement.outputTokens,\n        confidenceSource: measurement.source,\n        isError: false,\n      });\n    } finally {\n      store.close();\n    }\n  } catch {\n    // Fail-open: a telemetry error must NEVER break the hook runtime.\n  }\n}\n\n/**\n * Dispatch one host hook invocation. Always resolves (never rejects): every\n * failure path returns a concrete {@link RunHookResult} so the CLI can exit\n * cleanly. See the module header for the fail-open contract.\n */\nexport async function runHook(opts: RunHookOptions): Promise<RunHookResult> {\n  const { platformId, event, connectorId, stdin } = opts;\n\n  try {\n    const connector = await loadRegisteredConnector(connectorId);\n    const adapter = await loadAdapter(platformId);\n\n    // mcp-only hosts (and any adapter without runtime dispatch) cannot parse a\n    // hook payload — nothing to do, allow.\n    if (!adapter || !adapter.parseEvent || !adapter.formatReply) {\n      return ALLOW;\n    }\n\n    const raw = parseStdin(stdin);\n    const evt = adapter.parseEvent(event, raw);\n    // The hook command carries the authoritative connector id; stamp it on the\n    // event so handlers see the connector they were dispatched for.\n    evt.connectorId = connectorId;\n    // Unify the hook event with HostCtx: the adapter's parseEvent has no\n    // capabilities/scope/telemetry at parse time (they are runtime-only), so the\n    // runtime ALWAYS backfills them before the handler runs. capabilities comes\n    // from the adapter; scope is recovered from the registered metadata (sync);\n    // telemetry is the lazy per-connector usage accessor. The SAME three\n    // assignments run on the error path (failOpenOrPreserveDeny) for symmetry.\n    evt.capabilities = adapter.capabilities;\n    evt.scope = readRegisteredMeta(connectorId)?.scope;\n    evt.telemetry = buildTelemetryAccessor(connectorId);\n\n    const definition = connector.hooks[event];\n    if (!definition || typeof definition.handler !== \"function\") {\n      // The connector declares no handler for this event — allow.\n      return ALLOW;\n    }\n\n    // Per-host handler override: when dispatching for host X, `hosts[X].handler`\n    // wins over the top-level handler; a host not listed (or a per-host entry\n    // that is somehow not a function) falls back to the top-level handler.\n    // Selection NEVER throws — fail-open is preserved.\n    // NOTE: keyed on the RAW install-baked platformId (the host this entrypoint\n    // was registered for), NOT resolveHookHostPlatform's AGENT_CONNECTOR_HOST\n    // override — that override only re-labels the telemetry row. The error path\n    // (failOpenOrPreserveDeny) resolves the IDENTICAL handler the same way, so a\n    // per-host deny is preserved consistently.\n    const perHost = definition.hosts?.[platformId as PlatformId]?.handler;\n    const handler = typeof perHost === \"function\" ? perHost : definition.handler;\n\n    // Matcher: if set and the event's subject (tool name, or agent type for\n    // Subagent* events) does not match, allow (the hook is simply not\n    // interested in this tool/agent). The matcher is the definition's — a\n    // per-host handler shares the top-level matcher.\n    const subject = eventMatcherSubject(evt);\n    if (subject !== undefined) {\n      const re = compileMatcher(definition.matcher);\n      if (re && !re.test(subject)) return ALLOW;\n    }\n\n    // Run the resolved handler. Its return is normalized (void → allow) and\n    // handed to the adapter to render the host-native reply.\n    const handlerResult = await handler(\n      // The adapter parsed `evt` as exactly this event's payload type; the\n      // HooksConfig handler for the same event expects that payload.\n      evt as never,\n    );\n    const response = normalizeResponse(handlerResult);\n\n    // Developer-axis telemetry for the RUNTIME `hook` surface. Fail-open: never\n    // lets a measurement error break the hook (handled inside the helper).\n    recordHookTelemetry(opts, connector, evt, response);\n\n    const reply = adapter.formatReply(event, response);\n    return {\n      exitCode: reply.exitCode,\n      ...(reply.stdout !== undefined ? { stdout: reply.stdout } : {}),\n      ...(reply.stderr !== undefined ? { stderr: reply.stderr } : {}),\n    };\n  } catch (err) {\n    // Fail-open: a framework/handler error must not wedge the host's tool call.\n    // The ONE exception is a PreToolUse / PermissionRequest deny — a deliberate\n    // block we honor even if a later step threw. We re-derive that decision\n    // defensively from the adapter so a throw AFTER the deny still surfaces it.\n    const message = err instanceof Error ? err.message : String(err);\n    log.error(`hook ${platformId}/${event} (${connectorId}) failed:`, message);\n    return failOpenOrPreserveDeny(opts, message);\n  }\n}\n\n/**\n * Events whose explicit deny survives the fail-open error path. Both are\n * permission gates — a deny there is a deliberate security decision that must\n * never be silently downgraded to allow. (Stop-class denies are persistence\n * conveniences, not security boundaries, so they stay fail-open.)\n */\nconst DENY_PRESERVE_EVENTS: ReadonlySet<HookEventName> = new Set([\n  \"PreToolUse\",\n  \"PermissionRequest\",\n]);\n\n/**\n * Error path. Returns fail-open allow, UNLESS this is a deny-preserving event\n * (PreToolUse / PermissionRequest) whose handler explicitly denied — in which\n * case the deny is reconstructed and preserved (a security decision is never\n * silently downgraded to allow).\n *\n * Best-effort: if anything in the deny reconstruction itself throws, we fall\n * back to allow (we never escalate an error into a spurious block).\n */\nasync function failOpenOrPreserveDeny(\n  opts: RunHookOptions,\n  errorMessage: string,\n): Promise<RunHookResult> {\n  if (!DENY_PRESERVE_EVENTS.has(opts.event)) return ALLOW;\n  try {\n    const connector = await loadRegisteredConnector(opts.connectorId);\n    const adapter = await loadAdapter(opts.platformId);\n    if (!adapter?.parseEvent || !adapter.formatReply) return ALLOW;\n\n    const definition = connector.hooks[opts.event];\n    if (!definition || typeof definition.handler !== \"function\") return ALLOW;\n\n    // Reconstruct the deny from the SAME handler the main path would have run —\n    // the per-host override if one is declared for this host, else the top-level\n    // handler. Otherwise a per-host deny could be silently downgraded on the\n    // error path.\n    const perHost = definition.hosts?.[opts.platformId as PlatformId]?.handler;\n    const handler = typeof perHost === \"function\" ? perHost : definition.handler;\n\n    const raw = parseStdin(opts.stdin);\n    const evt = adapter.parseEvent(opts.event, raw);\n    evt.connectorId = opts.connectorId;\n    // Backfill the HostCtx fields here too (symmetry with the main path), so a\n    // per-host deny reconstructed on the error path still carries capabilities/\n    // scope/telemetry — a handler that branches on them denies identically.\n    evt.capabilities = adapter.capabilities;\n    evt.scope = readRegisteredMeta(opts.connectorId)?.scope;\n    evt.telemetry = buildTelemetryAccessor(opts.connectorId);\n\n    const subject = eventMatcherSubject(evt);\n    if (subject !== undefined) {\n      const re = compileMatcher(definition.matcher);\n      if (re && !re.test(subject)) return ALLOW;\n    }\n\n    const response = normalizeResponse(await handler(evt as never));\n    if (response.decision !== \"deny\") return ALLOW;\n\n    const reply = adapter.formatReply(opts.event, response);\n    return {\n      exitCode: reply.exitCode,\n      ...(reply.stdout !== undefined ? { stdout: reply.stdout } : {}),\n      ...(reply.stderr !== undefined\n        ? { stderr: reply.stderr }\n        : { stderr: errorMessage }),\n    };\n  } catch {\n    // Reconstruction failed — never escalate an internal error into a block.\n    return ALLOW;\n  }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// Native (passthrough) hooks — host events OUTSIDE the normalized union\n// ─────────────────────────────────────────────────────────────────────────\n\n/** Flags + stdin for {@link runNativeHook}. `event` is HOST-NATIVE (non-union). */\nexport interface RunNativeHookOptions {\n  /** Host platform id from the hook command (`hook <platformId> ...`). */\n  platformId: string;\n  /** Host-native event name, verbatim (e.g. \"TaskCreated\"). */\n  event: string;\n  /** Connector id from `--connector <id>`. */\n  connectorId: string;\n  /** Raw stdin payload (host-native JSON). Empty string is tolerated → `{}`. */\n  stdin: string;\n}\n\n/** The connector's native hook definition for `platformId`/`event`, if any. */\nfunction nativeHookDef(\n  connector: ResolvedConnector,\n  platformId: string,\n  event: string,\n): NativeHookDef | undefined {\n  return connector.platforms[platformId as PlatformId]?.nativeHooks?.[event];\n}\n\n/**\n * True when the registered connector declares `event` under\n * `platforms[platformId].nativeHooks` with a live handler. Used by the hook CLI\n * to decide whether a non-union event name is accepted (declared → dispatch via\n * {@link runNativeHook}) or rejected with the strict unknown-event error.\n * Fail-safe: any load error reads as \"not declared\".\n */\nexport async function isNativeHookDeclared(\n  platformId: string,\n  event: string,\n  connectorId: string,\n): Promise<boolean> {\n  try {\n    const connector = await loadRegisteredConnector(connectorId);\n    return typeof nativeHookDef(connector, platformId, event)?.handler === \"function\";\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Dispatch one NATIVE (passthrough) hook invocation. No normalized parse, no\n * HookResponse mapping, no runtime matcher evaluation (the host's own matcher\n * already filtered — the def's matcher string was written verbatim into the\n * host config at install):\n *\n *   stdin JSON → NativeHookEvent{raw} → handler → VERBATIM JSON stdout (exit 0).\n *\n * void/undefined return → exit 0 with no output. Fail-open: ANY throw degrades\n * to exit 0 with no output — exit-2 blocking semantics are not modeled in v1.\n * Telemetry: records the same scope:\"hook\" developer-axis row as normalized\n * hooks, with the NATIVE event name as the per-item name.\n */\nexport async function runNativeHook(\n  opts: RunNativeHookOptions,\n): Promise<RunHookResult> {\n  const { platformId, event, connectorId, stdin } = opts;\n  try {\n    const connector = await loadRegisteredConnector(connectorId);\n    const def = nativeHookDef(connector, platformId, event);\n    if (!def || typeof def.handler !== \"function\") {\n      // Not declared for this platform — nothing to do, allow.\n      return ALLOW;\n    }\n\n    const raw = parseStdin(stdin);\n    // Best-effort session/project extraction from the json-stdio common shape\n    // (Claude Code: session_id / cwd). Everything else stays in `raw` untouched.\n    const sessionId =\n      typeof (raw as { session_id?: unknown })?.session_id === \"string\"\n        ? (raw as { session_id: string }).session_id\n        : \"\";\n    const cwd = (raw as { cwd?: unknown })?.cwd;\n    const evt: NativeHookEvent = {\n      event,\n      hostPlatform: REGISTERED_PLATFORM_IDS.has(platformId as PlatformId)\n        ? (platformId as PlatformId)\n        : \"unknown\",\n      sessionId,\n      ...(typeof cwd === \"string\" && cwd !== \"\" ? { projectDir: cwd } : {}),\n      raw,\n    };\n\n    const result = await def.handler(evt);\n\n    // Same scope:\"hook\" telemetry row as normalized hooks (fail-open inside).\n    recordHookTelemetry(opts, connector, evt, result === undefined ? {} : result);\n\n    if (result === undefined) return ALLOW; // void → exit 0, no output\n    const json = JSON.stringify(result);\n    // Non-JSON-serializable returns (functions/symbols) degrade to silence.\n    if (json === undefined) return ALLOW;\n    return { exitCode: 0, stdout: json };\n  } catch (err) {\n    // Fail-open, unconditionally: native hooks have no deny-preserve carve-out\n    // (there is no normalized decision to reconstruct).\n    const message = err instanceof Error ? err.message : String(err);\n    log.error(\n      `native hook ${platformId}/${event} (${connectorId}) failed:`,\n      message,\n    );\n    return ALLOW;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,OAA8B;AAAA,EAClC,aAAa;AAAA,EACb,cAAc;AAAA,EACd,aAAa;AAAA,EACb,OAAO;AACT;AAQO,SAAS,uBAAuB,aAAwC;AAC7E,SAAO,YAA4C;AACjD,QAAI,QAAQ,IAAI,8BAA8B,IAAK,QAAO,EAAE,GAAG,KAAK;AACpE,QAAI;AACF,YAAM,QAAQ,UAAU,CAAC,CAAC;AAC1B,UAAI;AACF,YAAI,cAAc;AAClB,YAAI,eAAe;AACnB,YAAI,QAAQ;AAKZ,mBAAW,OAAO,MAAM,MAAM,EAAE,YAAY,CAAC,GAAG;AAC9C,yBAAe,OAAO,SAAS,IAAI,WAAW,IAAI,IAAI,cAAc;AACpE,0BAAgB,OAAO,SAAS,IAAI,YAAY,IAAI,IAAI,eAAe;AACvE,mBAAS;AAAA,QACX;AACA,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA,aAAa,cAAc;AAAA,UAC3B;AAAA,QACF;AAAA,MACF,UAAE;AACA,cAAM,MAAM;AAAA,MACd;AAAA,IACF,QAAQ;AAEN,aAAO,EAAE,GAAG,KAAK;AAAA,IACnB;AAAA,EACF;AACF;;;AC9BA,IAAM,oBAA4C;AAAA,EAChD,OAAO;AAAA,EACP,OAAO;AAAA,EACP,UAAU;AACZ;AAEA,IAAM,yBAAyB;AAU/B,SAAS,eAAe,SAAwD;AAG9E,MAAI,QAA0B;AAC9B,aAAW,KAAK,QAAS,SAAQ,gBAAgB,OAAO,CAAC;AACzD,SAAO;AACT;AAoBA,SAAS,SAAS,GAA0C;AAC1D,SAAO,OAAO,MAAM,YAAY,MAAM;AACxC;AAEA,SAAS,YAAY,OAAyC;AAC5D,SAAO,MAAM,SAAS;AACxB;AAeO,SAAS,gBACd,MACA,QACA,QACA,MAAiB,aAAa,GACT;AACrB,QAAM,QAAQ,IAAI,WAAW,MAAM,MAAM;AACzC,QAAM,SAAS,cAAc,QAAQ,QAAQ,GAAG;AAChD,SAAO;AAAA,IACL,aAAa,MAAM;AAAA,IACnB,cAAc,OAAO;AAAA,IACrB,QAAQ,gBAAgB,MAAM,QAAQ,OAAO,MAAM;AAAA,EACrD;AACF;AAGA,SAAS,cACP,QACA,QACA,KACY;AACZ,MAAI,CAAC,SAAS,MAAM,GAAG;AAErB,WAAO,IAAI,WAAW,QAAQ,MAAM;AAAA,EACtC;AAEA,QAAM,MAAM;AACZ,QAAM,UAA8B,CAAC;AACrC,MAAI,SAAS;AAEb,MAAI,MAAM,QAAQ,IAAI,OAAO,GAAG;AAC9B,eAAW,OAAO,IAAI,SAAS;AAC7B,UAAI,CAAC,SAAS,GAAG,EAAG;AACpB,YAAM,QAAQ;AACd,UAAI,YAAY,KAAK,GAAG;AACtB,cAAM,OAAO,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;AAC3D,cAAM,IAAI,IAAI,MAAM,MAAM,MAAM;AAChC,kBAAU,EAAE;AACZ,gBAAQ,KAAK,EAAE,MAAM;AAAA,MACvB,OAAO;AAEL,cAAM,MAAM,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;AAC1D,kBAAU,kBAAkB,GAAG,KAAK;AAEpC,gBAAQ,KAAK,kBAAkB;AAAA,MACjC;AAAA,IACF;AAAA,EACF,WAAW,IAAI,YAAY,QAAW;AAEpC,UAAM,IAAI,IAAI,WAAW,IAAI,SAAS,MAAM;AAC5C,cAAU,EAAE;AACZ,YAAQ,KAAK,EAAE,MAAM;AAAA,EACvB;AAEA,MAAI,IAAI,sBAAsB,QAAW;AACvC,UAAM,IAAI,IAAI,WAAW,IAAI,mBAAmB,MAAM;AACtD,cAAU,EAAE;AACZ,YAAQ,KAAK,EAAE,MAAM;AAAA,EACvB;AAIA,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,IAAI,WAAW,QAAQ,MAAM;AAAA,EACtC;AAEA,SAAO,EAAE,QAAQ,QAAQ,eAAe,OAAO,EAAE;AACnD;AAQO,SAAS,gBACd,OACA,QACA,MAAiB,aAAa,GAClB;AACZ,SAAO,IAAI,WAAW,OAAO,MAAM;AACrC;AAeO,SAAS,YACd,cACA,eACA,QACA,MAAiB,aAAa,GACT;AACrB,QAAM,QAAQ,IAAI,WAAW,cAAc,MAAM;AACjD,QAAM,SAAS,IAAI,WAAW,eAAe,MAAM;AACnD,SAAO;AAAA,IACL,aAAa,MAAM;AAAA,IACnB,cAAc,OAAO;AAAA,IACrB,QAAQ,gBAAgB,MAAM,QAAQ,OAAO,MAAM;AAAA,EACrD;AACF;;;ACrJA,IAAM,QAAuB,EAAE,UAAU,EAAE;AAWpC,SAAS,oBAAoB,KAA0C;AAC5E,QAAM,OAAQ,IAA+B;AAC7C,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,QAAM,YAAa,IAAgC;AACnD,MAAI,OAAO,cAAc,SAAU,QAAO;AAC1C,SAAO;AACT;AAOA,SAAS,WAAW,OAAwB;AAC1C,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,YAAY,GAAI,QAAO,CAAC;AAC5B,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAOO,SAAS,eAAe,SAA4C;AACzE,MAAI,CAAC,WAAW,YAAY,GAAI,QAAO;AACvC,MAAI;AACF,WAAO,IAAI,OAAO,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO,CAAC;AACxD,SAAO;AACT;AAUA,SAAS,wBACP,YACA,KACY;AACZ,QAAM,WAAW,QAAQ,IAAI;AAC7B,MACE,aAAa,UACb,wBAAwB,IAAI,QAAsB,GAClD;AACA,WAAO;AAAA,EACT;AACA,MAAI,wBAAwB,IAAI,UAAwB,GAAG;AACzD,WAAO;AAAA,EACT;AACA,QAAM,YAAa,IAAmC;AACtD,MACE,OAAO,cAAc,YACrB,wBAAwB,IAAI,SAAuB,GACnD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAgBA,SAAS,oBACP,MACA,WACA,KACA,UACM;AACN,MAAI,QAAQ,IAAI,8BAA8B,IAAK;AACnD,MAAI;AACF,UAAM,SAAS,iBAAiB,IAAI,UAAU,UAAU,eAAe;AACvE,UAAM,cAAc,YAAY,KAAK,UAAU,QAAQ,aAAa,CAAC;AAErE,UAAM,YACJ,OAAQ,IAAgC,cAAc,WAChD,IAA8B,YAChC;AACN,UAAM,gBAAiB,IAAiC;AACxD,UAAM,aACJ,OAAO,kBAAkB,YAAY,kBAAkB,KACnD,gBACA,QAAQ,IAAI;AAClB,UAAM,KAAK,gBAAgB,UAAU;AAErC,UAAM,QAAQ,UAAU,CAAC,CAAC;AAC1B,QAAI;AACF,YAAM,OAAO;AAAA,QACX,IAAI,YAAY,CAAC;AAAA,QACjB,IAAI,KAAK,IAAI;AAAA,QACb,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK;AAAA;AAAA,QACf,OAAO;AAAA,QACP,aAAa;AAAA,QACb,cAAc,wBAAwB,KAAK,YAAY,GAAG;AAAA,QAC1D;AAAA,QACA,YAAY,GAAG;AAAA,QACf,YAAY,GAAG;AAAA,QACf,aAAa,YAAY;AAAA,QACzB,cAAc,YAAY;AAAA,QAC1B,kBAAkB,YAAY;AAAA,QAC9B,SAAS;AAAA,MACX,CAAC;AAAA,IACH,UAAE;AACA,YAAM,MAAM;AAAA,IACd;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAOA,eAAsB,QAAQ,MAA8C;AAC1E,QAAM,EAAE,YAAY,OAAO,aAAa,MAAM,IAAI;AAElD,MAAI;AACF,UAAM,YAAY,MAAM,wBAAwB,WAAW;AAC3D,UAAM,UAAU,MAAM,YAAY,UAAU;AAI5C,QAAI,CAAC,WAAW,CAAC,QAAQ,cAAc,CAAC,QAAQ,aAAa;AAC3D,aAAO;AAAA,IACT;AAEA,UAAM,MAAM,WAAW,KAAK;AAC5B,UAAM,MAAM,QAAQ,WAAW,OAAO,GAAG;AAGzC,QAAI,cAAc;AAOlB,QAAI,eAAe,QAAQ;AAC3B,QAAI,QAAQ,mBAAmB,WAAW,GAAG;AAC7C,QAAI,YAAY,uBAAuB,WAAW;AAElD,UAAM,aAAa,UAAU,MAAM,KAAK;AACxC,QAAI,CAAC,cAAc,OAAO,WAAW,YAAY,YAAY;AAE3D,aAAO;AAAA,IACT;AAWA,UAAM,UAAU,WAAW,QAAQ,UAAwB,GAAG;AAC9D,UAAM,UAAU,OAAO,YAAY,aAAa,UAAU,WAAW;AAMrE,UAAM,UAAU,oBAAoB,GAAG;AACvC,QAAI,YAAY,QAAW;AACzB,YAAM,KAAK,eAAe,WAAW,OAAO;AAC5C,UAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAG,QAAO;AAAA,IACtC;AAIA,UAAM,gBAAgB,MAAM;AAAA;AAAA;AAAA,MAG1B;AAAA,IACF;AACA,UAAM,WAAW,kBAAkB,aAAa;AAIhD,wBAAoB,MAAM,WAAW,KAAK,QAAQ;AAElD,UAAM,QAAQ,QAAQ,YAAY,OAAO,QAAQ;AACjD,WAAO;AAAA,MACL,UAAU,MAAM;AAAA,MAChB,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC7D,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC/D;AAAA,EACF,SAAS,KAAK;AAKZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAI,MAAM,QAAQ,UAAU,IAAI,KAAK,KAAK,WAAW,aAAa,OAAO;AACzE,WAAO,uBAAuB,MAAM,OAAO;AAAA,EAC7C;AACF;AAQA,IAAM,uBAAmD,oBAAI,IAAI;AAAA,EAC/D;AAAA,EACA;AACF,CAAC;AAWD,eAAe,uBACb,MACA,cACwB;AACxB,MAAI,CAAC,qBAAqB,IAAI,KAAK,KAAK,EAAG,QAAO;AAClD,MAAI;AACF,UAAM,YAAY,MAAM,wBAAwB,KAAK,WAAW;AAChE,UAAM,UAAU,MAAM,YAAY,KAAK,UAAU;AACjD,QAAI,CAAC,SAAS,cAAc,CAAC,QAAQ,YAAa,QAAO;AAEzD,UAAM,aAAa,UAAU,MAAM,KAAK,KAAK;AAC7C,QAAI,CAAC,cAAc,OAAO,WAAW,YAAY,WAAY,QAAO;AAMpE,UAAM,UAAU,WAAW,QAAQ,KAAK,UAAwB,GAAG;AACnE,UAAM,UAAU,OAAO,YAAY,aAAa,UAAU,WAAW;AAErE,UAAM,MAAM,WAAW,KAAK,KAAK;AACjC,UAAM,MAAM,QAAQ,WAAW,KAAK,OAAO,GAAG;AAC9C,QAAI,cAAc,KAAK;AAIvB,QAAI,eAAe,QAAQ;AAC3B,QAAI,QAAQ,mBAAmB,KAAK,WAAW,GAAG;AAClD,QAAI,YAAY,uBAAuB,KAAK,WAAW;AAEvD,UAAM,UAAU,oBAAoB,GAAG;AACvC,QAAI,YAAY,QAAW;AACzB,YAAM,KAAK,eAAe,WAAW,OAAO;AAC5C,UAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAG,QAAO;AAAA,IACtC;AAEA,UAAM,WAAW,kBAAkB,MAAM,QAAQ,GAAY,CAAC;AAC9D,QAAI,SAAS,aAAa,OAAQ,QAAO;AAEzC,UAAM,QAAQ,QAAQ,YAAY,KAAK,OAAO,QAAQ;AACtD,WAAO;AAAA,MACL,UAAU,MAAM;AAAA,MAChB,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC7D,GAAI,MAAM,WAAW,SACjB,EAAE,QAAQ,MAAM,OAAO,IACvB,EAAE,QAAQ,aAAa;AAAA,IAC7B;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAmBA,SAAS,cACP,WACA,YACA,OAC2B;AAC3B,SAAO,UAAU,UAAU,UAAwB,GAAG,cAAc,KAAK;AAC3E;AASA,eAAsB,qBACpB,YACA,OACA,aACkB;AAClB,MAAI;AACF,UAAM,YAAY,MAAM,wBAAwB,WAAW;AAC3D,WAAO,OAAO,cAAc,WAAW,YAAY,KAAK,GAAG,YAAY;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeA,eAAsB,cACpB,MACwB;AACxB,QAAM,EAAE,YAAY,OAAO,aAAa,MAAM,IAAI;AAClD,MAAI;AACF,UAAM,YAAY,MAAM,wBAAwB,WAAW;AAC3D,UAAM,MAAM,cAAc,WAAW,YAAY,KAAK;AACtD,QAAI,CAAC,OAAO,OAAO,IAAI,YAAY,YAAY;AAE7C,aAAO;AAAA,IACT;AAEA,UAAM,MAAM,WAAW,KAAK;AAG5B,UAAM,YACJ,OAAQ,KAAkC,eAAe,WACpD,IAA+B,aAChC;AACN,UAAM,MAAO,KAA2B;AACxC,UAAM,MAAuB;AAAA,MAC3B;AAAA,MACA,cAAc,wBAAwB,IAAI,UAAwB,IAC7D,aACD;AAAA,MACJ;AAAA,MACA,GAAI,OAAO,QAAQ,YAAY,QAAQ,KAAK,EAAE,YAAY,IAAI,IAAI,CAAC;AAAA,MACnE;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,IAAI,QAAQ,GAAG;AAGpC,wBAAoB,MAAM,WAAW,KAAK,WAAW,SAAY,CAAC,IAAI,MAAM;AAE5E,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,OAAO,KAAK,UAAU,MAAM;AAElC,QAAI,SAAS,OAAW,QAAO;AAC/B,WAAO,EAAE,UAAU,GAAG,QAAQ,KAAK;AAAA,EACrC,SAAS,KAAK;AAGZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAI;AAAA,MACF,eAAe,UAAU,IAAI,KAAK,KAAK,WAAW;AAAA,MAClD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-GSGDG2BV.js → chunk-4ENJK5S2.js}

@@ -1,162 +1,18 @@
 #!/usr/bin/env node
+import {
+  REGISTERED_PLATFORM_IDS
+} from "./chunk-DCKFYWGM.js";
+import {
+  CONFIG_PATCH_SEGMENT_RE,
+  configPatchNamespaceViolation,
+  isJsonValue,
+  isValidConfigPatchKey
+} from "./chunk-FAHIMJRU.js";
 import {
   MANAGED_BLOCK_BEGIN_TOKEN,
   MANAGED_BLOCK_END_TOKEN,
   MEMORY_CONTENT_HARD_CAP_BYTES
 } from "./chunk-N6HH7K6P.js";
-import {
-  ensureDir
-} from "./chunk-TRQKHP7D.js";
-
-// src/core/config-patch-ledger.ts
-import { createHash, randomBytes } from "crypto";
-import {
-  existsSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-  writeFileSync
-} from "fs";
-import { dirname, join } from "path";
-var CONFIG_PATCH_SEGMENT_RE = /^[A-Za-z0-9_-]+$/;
-function isValidConfigPatchKey(key) {
-  if (typeof key !== "string" || key.length === 0) return false;
-  return key.split(".").every((seg) => CONFIG_PATCH_SEGMENT_RE.test(seg));
-}
-function isJsonValue(value) {
-  if (value === null) return true;
-  switch (typeof value) {
-    case "string":
-    case "boolean":
-      return true;
-    case "number":
-      return Number.isFinite(value);
-    case "object":
-      break;
-    default:
-      return false;
-  }
-  if (Array.isArray(value)) return value.every((v) => isJsonValue(v));
-  const proto = Object.getPrototypeOf(value);
-  if (proto !== Object.prototype && proto !== null) return false;
-  return Object.values(value).every((v) => isJsonValue(v));
-}
-function configPatchNamespaceViolation(key) {
-  const head = key.split(".")[0] ?? "";
-  if (head === "hooks") {
-    return `"${key}" targets the hooks config agent-connector already models; declare it via \`hooks\` (normalized) or \`platforms.<id>.nativeHooks\` instead`;
-  }
-  if (head === "mcpServers" || head === "enableAllProjectMcpServers" || head === "enabledMcpjsonServers" || head === "disabledMcpjsonServers") {
-    return `"${key}" targets MCP server registration agent-connector already models; declare it via \`server\` / \`platforms.<id>.server\` / \`extra\` instead`;
-  }
-  return null;
-}
-function configPatchManualEdit(patch) {
-  const docs = patch.docsUrl ? ` \u2014 see ${patch.docsUrl}` : "";
-  return `manual edit if wanted: set ${patch.key} = ${describeJsonValue(patch.value)} (${patch.reason})${docs}`;
-}
-function describeJsonValue(value) {
-  if (value === void 0) return "<absent>";
-  try {
-    return JSON.stringify(value);
-  } catch {
-    return String(value);
-  }
-}
-function canonicalJson(value) {
-  if (value === void 0) return "undefined";
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) {
-    return `[${value.map((v) => canonicalJson(v)).join(",")}]`;
-  }
-  const keys = Object.keys(value).sort();
-  const parts = keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(value[k])}`);
-  return `{${parts.join(",")}}`;
-}
-function hashJsonValue(value) {
-  return createHash("sha256").update(canonicalJson(value)).digest("hex");
-}
-function jsonDeepEquals(a, b) {
-  return canonicalJson(a) === canonicalJson(b);
-}
-function configPatchLedgerPath(dataRoot) {
-  return join(dataRoot, "state", "config-patches.json");
-}
-function loadConfigPatchLedger(dataRoot) {
-  const path = configPatchLedgerPath(dataRoot);
-  if (!existsSync(path)) return { version: 1, entries: [] };
-  try {
-    const parsed = JSON.parse(readFileSync(path, "utf8"));
-    if (!parsed || !Array.isArray(parsed.entries)) return { version: 1, entries: [] };
-    return { version: 1, entries: parsed.entries.filter(isPlausibleEntry) };
-  } catch {
-    return { version: 1, entries: [] };
-  }
-}
-function isPlausibleEntry(e) {
-  if (e == null || typeof e !== "object") return false;
-  const entry = e;
-  return typeof entry.platform === "string" && typeof entry.file === "string" && typeof entry.key === "string" && Array.isArray(entry.owners);
-}
-function saveConfigPatchLedger(dataRoot, ledger) {
-  const path = configPatchLedgerPath(dataRoot);
-  ensureDir(dirname(path));
-  const tmpFile = `${path}.${process.pid}-${randomBytes(4).toString("hex")}.tmp`;
-  try {
-    writeFileSync(tmpFile, `${JSON.stringify(ledger, null, 2)}
-`, "utf8");
-    renameSync(tmpFile, path);
-  } catch (err) {
-    rmSync(tmpFile, { force: true });
-    throw err;
-  }
-}
-function findLedgerEntry(ledger, platform, file, key) {
-  return ledger.entries.find(
-    (e) => e.platform === platform && e.file === file && e.key === key
-  );
-}
-function ledgerEntriesOwnedBy(ledger, platform, connectorId) {
-  return ledger.entries.filter(
-    (e) => e.platform === platform && e.owners.some((o) => o.connectorId === connectorId)
-  );
-}
-function createLedgerEntry(ledger, init) {
-  const entry = {
-    platform: init.platform,
-    file: init.file,
-    key: init.key,
-    writtenValue: init.value,
-    writtenValueHash: hashJsonValue(init.value),
-    prior: { present: false },
-    owners: [
-      {
-        connectorId: init.connectorId,
-        connectorVersion: init.connectorVersion,
-        installedAt: (/* @__PURE__ */ new Date()).toISOString()
-      }
-    ]
-  };
-  ledger.entries.push(entry);
-  return entry;
-}
-function addLedgerOwner(entry, connectorId, connectorVersion) {
-  if (entry.owners.some((o) => o.connectorId === connectorId)) return false;
-  entry.owners.push({
-    connectorId,
-    connectorVersion,
-    installedAt: (/* @__PURE__ */ new Date()).toISOString()
-  });
-  return true;
-}
-function removeLedgerOwner(entry, connectorId) {
-  const before = entry.owners.length;
-  entry.owners = entry.owners.filter((o) => o.connectorId !== connectorId);
-  return { removed: entry.owners.length < before, lastOwner: entry.owners.length === 0 };
-}
-function dropLedgerEntry(ledger, entry) {
-  ledger.entries = ledger.entries.filter((e) => e !== entry);
-}
 
 // src/core/define-connector.ts
 import { isAbsolute, normalize } from "path";
@@ -203,7 +59,8 @@ var ALL_EVENTS = [
   "PermissionRequest",
   "PostToolUseFailure",
   "SubagentStart",
-  "SubagentStop"
+  "SubagentStop",
+  "PostCompact"
 ];
 var ConnectorConfigError = class extends Error {
   constructor(message) {
@@ -228,15 +85,17 @@ function defineConnector(config) {
   const hasSkills = Array.isArray(config.skills) && config.skills.length > 0;
   const hasSubagents = Array.isArray(config.subagents) && config.subagents.length > 0;
   const hasMemory = Array.isArray(config.memory) && config.memory.length > 0;
+  const hasStatusline = config.statusline != null;
+  const hasActions = Array.isArray(config.actions) && config.actions.length > 0;
   const hasNativeHooks = Object.values(config.platforms ?? {}).some(
     (override) => override?.nativeHooks != null && Object.keys(override.nativeHooks).length > 0
   );
   const hasConfigPatch = Object.values(config.platforms ?? {}).some(
     (override) => Array.isArray(override?.configPatch) && override.configPatch.length > 0
   );
-  if (!config.server && !config.hooks && !hasCommands && !hasSkills && !hasSubagents && !hasMemory && !hasNativeHooks && !hasConfigPatch) {
+  if (!config.server && !config.hooks && !hasCommands && !hasSkills && !hasSubagents && !hasMemory && !hasStatusline && !hasActions && !hasNativeHooks && !hasConfigPatch) {
     throw new ConnectorConfigError(
-      "a connector must declare at least one of `server`, `hooks`, `commands`, `skills`, `subagents`, `memory`, or a per-platform `nativeHooks` / `configPatch` declaration"
+      "a connector must declare at least one of `server`, `hooks`, `commands`, `skills`, `subagents`, `memory`, `statusline`, `actions`, or a per-platform `nativeHooks` / `configPatch` declaration"
     );
   }
   if (config.server) {
@@ -261,6 +120,7 @@ function defineConnector(config) {
       if (def != null && typeof def.handler !== "function") {
         throw new ConnectorConfigError(`hooks.${ev}.handler must be a function`);
       }
+      validateHostsMap(def?.hosts, `hooks.${ev}.hosts`, "handler");
     }
   }
   validateNativeHooks(config.platforms);
@@ -269,6 +129,8 @@ function defineConnector(config) {
   const skills = normalizeSkills(config.skills);
   const subagents = normalizeSubagents(config.subagents);
   const memory = normalizeMemory(config.memory);
+  const statusline = normalizeStatusline(config.statusline);
+  const actions = normalizeActions(config.actions);
   const t = config.telemetry ?? {};
   const resolved = {
     id: config.id,
@@ -293,6 +155,8 @@ function defineConnector(config) {
     skills,
     subagents,
     memory,
+    ...statusline ? { statusline } : {},
+    actions,
     platforms: config.platforms ?? {},
     targets: config.targets ?? "auto",
     ...config.publish ? { publish: normalizePublish(config.publish) } : {}
@@ -300,6 +164,27 @@ function defineConnector(config) {
   return resolved;
 }
 var NORMALIZED_EVENT_SET = new Set(ALL_EVENTS);
+function validateHostsMap(map, surfaceLabel, implField) {
+  if (map == null) return;
+  if (typeof map !== "object" || Array.isArray(map)) {
+    throw new ConnectorConfigError(
+      `${surfaceLabel} must be an object keyed by platform id`
+    );
+  }
+  for (const [platformId, entry] of Object.entries(map)) {
+    if (!REGISTERED_PLATFORM_IDS.has(platformId)) {
+      const valid = [...REGISTERED_PLATFORM_IDS].sort().join(", ");
+      throw new ConnectorConfigError(
+        `unknown platform id "${platformId}" in hosts map for ${surfaceLabel}; valid ids: ${valid}`
+      );
+    }
+    if (entry == null || typeof entry !== "object" || typeof entry[implField] !== "function") {
+      throw new ConnectorConfigError(
+        `${surfaceLabel}.${platformId}.${implField} must be a function`
+      );
+    }
+  }
+}
 function validateNativeHooks(platforms) {
   if (platforms == null) return;
   for (const [platformId, override] of Object.entries(platforms)) {
@@ -394,10 +279,10 @@ function normalizePublish(publish) {
   }
   return { ...publish };
 }
-function assertSurfaceName(surface, name, index) {
+function assertSurfaceName(surface, name, index, field = "name") {
   if (typeof name !== "string" || !SURFACE_NAME_RE.test(name)) {
     throw new ConnectorConfigError(
-      `${surface}[${index}].name must be kebab-case matching ${SURFACE_NAME_RE} (got ${JSON.stringify(name)})`
+      `${surface}[${index}].${field} must be kebab-case matching ${SURFACE_NAME_RE} (got ${JSON.stringify(name)})`
     );
   }
   return name;
@@ -408,9 +293,9 @@ function assertNonEmptyString(surface, index, field, value) {
   }
   return value;
 }
-function assertNoDuplicate(surface, seen, name, index) {
+function assertNoDuplicate(surface, seen, name, index, field = "name") {
   if (seen.has(name)) {
-    throw new ConnectorConfigError(`${surface}[${index}] duplicate name "${name}"`);
+    throw new ConnectorConfigError(`${surface}[${index}] duplicate ${field} "${name}"`);
   }
   seen.add(name);
 }
@@ -511,6 +396,56 @@ function normalizeMemory(input) {
     return { ...entry, name };
   });
 }
+var STATUSLINE_DEFAULT_NAME = "statusline";
+function normalizeStatusline(input) {
+  if (input == null) return void 0;
+  if (typeof input !== "object" || Array.isArray(input)) {
+    throw new ConnectorConfigError("statusline must be an object");
+  }
+  if (typeof input.render !== "function") {
+    throw new ConnectorConfigError("statusline.render must be a function");
+  }
+  const name = input.name === void 0 ? STATUSLINE_DEFAULT_NAME : assertSurfaceName("statusline", input.name, 0);
+  if (input.description !== void 0 && typeof input.description !== "string") {
+    throw new ConnectorConfigError("statusline.description must be a string");
+  }
+  validateHostsMap(input.hosts, "statusline.hosts", "render");
+  return { ...input, name };
+}
+function normalizeActions(input) {
+  if (input == null) return [];
+  if (!Array.isArray(input)) {
+    throw new ConnectorConfigError("actions must be an array");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return input.map((action, i) => {
+    if (!action || typeof action !== "object" || Array.isArray(action)) {
+      throw new ConnectorConfigError(`actions[${i}] must be an object`);
+    }
+    const id = assertSurfaceName("actions", action.id, i, "id");
+    assertNoDuplicate("actions", seen, id, i, "id");
+    if (typeof action.run !== "function") {
+      throw new ConnectorConfigError(`actions[${i}].run must be a function`);
+    }
+    if (action.description !== void 0 && typeof action.description !== "string") {
+      throw new ConnectorConfigError(`actions[${i}].description must be a string`);
+    }
+    validateHostsMap(action.hosts, `actions.${id}.hosts`, "run");
+    return { ...action, id };
+  });
+}
+var defineStatusline = (def) => def;
+var defineHook = (event, def) => {
+  void event;
+  return def;
+};
+var defineCommand = (def) => def;
+var defineSkill = (def) => def;
+var defineSubagent = (def) => def;
+var defineMemory = (def) => def;
+var defineAction = (def) => def;
+var defineConfigPatch = (def) => def;
+var defineNativeHook = (def) => def;
 function normalizeSubagents(input) {
   if (input == null) return [];
   if (!Array.isArray(input)) {
@@ -548,21 +483,16 @@ export {
   isConcreteSemver,
   isPlaceholderVersion,
   REGISTRY_NAME_RE,
-  isValidConfigPatchKey,
-  configPatchNamespaceViolation,
-  configPatchManualEdit,
-  describeJsonValue,
-  hashJsonValue,
-  jsonDeepEquals,
-  loadConfigPatchLedger,
-  saveConfigPatchLedger,
-  findLedgerEntry,
-  ledgerEntriesOwnedBy,
-  createLedgerEntry,
-  addLedgerOwner,
-  removeLedgerOwner,
-  dropLedgerEntry,
   ConnectorConfigError,
-  defineConnector
+  defineConnector,
+  defineStatusline,
+  defineHook,
+  defineCommand,
+  defineSkill,
+  defineSubagent,
+  defineMemory,
+  defineAction,
+  defineConfigPatch,
+  defineNativeHook
 };
-//# sourceMappingURL=chunk-GSGDG2BV.js.map
+//# sourceMappingURL=chunk-4ENJK5S2.js.map

package/dist/chunk-4ENJK5S2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/define-connector.ts","../src/core/mcp-standard.ts"],"sourcesContent":["/**\n * core/define-connector — the public write-once entry point.\n *\n * Validates a ConnectorConfig and normalizes it into a ResolvedConnector with\n * every optional field resolved to a default. Validation is intentionally\n * dependency-free (no zod) to keep the single-binary install lean.\n */\n\nimport { isAbsolute, normalize } from \"node:path\";\n\nimport type {\n  ActionDef,\n  CommandDef,\n  ConfigPatchDef,\n  ConnectorConfig,\n  HookDefinition,\n  HookEventName,\n  HooksConfig,\n  MemoryDef,\n  NativeHookDef,\n  PlatformId,\n  PublishConfig,\n  ResolvedConnector,\n  SkillDef,\n  StatuslineDef,\n  SubagentDef,\n} from \"./types.js\";\nimport { REGISTERED_PLATFORM_IDS } from \"../adapters/registry.js\";\nimport { REGISTRY_NAMESPACE_RE } from \"./mcp-standard.js\";\nimport {\n  MANAGED_BLOCK_BEGIN_TOKEN,\n  MANAGED_BLOCK_END_TOKEN,\n  MEMORY_CONTENT_HARD_CAP_BYTES,\n} from \"./managed-block.js\";\nimport {\n  CONFIG_PATCH_SEGMENT_RE,\n  configPatchNamespaceViolation,\n  isJsonValue,\n  isValidConfigPatchKey,\n} from \"./config-patch-ledger.js\";\n\nconst ID_RE = /^[a-z0-9][a-z0-9-]*$/;\n\n/** kebab-case name regex shared by command/skill/subagent names. */\nconst SURFACE_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;\n\n/** Max length of a skill description (Agent Skills open standard). */\nconst SKILL_DESCRIPTION_MAX = 1024;\n\n// NOTE: canonical ordering — append new events at the END (hookEvents ordering\n// is pinned by tests and feeds install-file ordering). Exported so the\n// hook-dispatch gate + Claude-bundle event sets can be drift-tested against it.\nexport const ALL_EVENTS: HookEventName[] = [\n  \"SessionStart\",\n  \"SessionEnd\",\n  \"UserPromptSubmit\",\n  \"PreToolUse\",\n  \"PostToolUse\",\n  \"PreCompact\",\n  \"Stop\",\n  \"Notification\",\n  \"PermissionRequest\",\n  \"PostToolUseFailure\",\n  \"SubagentStart\",\n  \"SubagentStop\",\n  \"PostCompact\",\n];\n\n/** Thrown on an invalid connector configuration. */\nexport class ConnectorConfigError extends Error {\n  constructor(message: string) {\n    super(`Invalid connector config: ${message}`);\n    this.name = \"ConnectorConfigError\";\n  }\n}\n\nfunction declaredEvents(hooks: HooksConfig | undefined): HookEventName[] {\n  if (!hooks) return [];\n  return ALL_EVENTS.filter((e) => typeof hooks[e]?.handler === \"function\");\n}\n\n/**\n * Validate + normalize a connector definition.\n * Returns a ResolvedConnector that adapters and the CLI consume directly.\n */\nexport function defineConnector(config: ConnectorConfig): ResolvedConnector {\n  if (!config || typeof config !== \"object\") {\n    throw new ConnectorConfigError(\"config must be an object\");\n  }\n  if (typeof config.id !== \"string\" || !ID_RE.test(config.id)) {\n    throw new ConnectorConfigError(\n      `id must be kebab-case matching ${ID_RE} (got ${JSON.stringify(config.id)})`,\n    );\n  }\n  const hasCommands = Array.isArray(config.commands) && config.commands.length > 0;\n  const hasSkills = Array.isArray(config.skills) && config.skills.length > 0;\n  const hasSubagents = Array.isArray(config.subagents) && config.subagents.length > 0;\n  const hasMemory = Array.isArray(config.memory) && config.memory.length > 0;\n  // A statusline (a HUD) is a legitimate sole payload — a connector whose whole\n  // job is rendering a status line. SINGULAR (one per connector), so a plain\n  // presence check (object with a render handler — validated in normalizeStatusline).\n  const hasStatusline = config.statusline != null;\n  // Actions (each a user-invokable run handler) are a legitimate sole payload —\n  // a connector whose whole job is shipping dispatchable actions.\n  const hasActions = Array.isArray(config.actions) && config.actions.length > 0;\n  // A platform-scoped nativeHooks declaration is a legitimate sole payload\n  // (a hooks-only connector wired entirely through native passthrough events).\n  const hasNativeHooks = Object.values(config.platforms ?? {}).some(\n    (override) =>\n      override?.nativeHooks != null && Object.keys(override.nativeHooks).length > 0,\n  );\n  // Likewise a platform-scoped configPatch declaration (a connector whose whole\n  // job is asserting a host config key, e.g. an experimental feature flag).\n  const hasConfigPatch = Object.values(config.platforms ?? {}).some(\n    (override) => Array.isArray(override?.configPatch) && override.configPatch.length > 0,\n  );\n  if (\n    !config.server &&\n    !config.hooks &&\n    !hasCommands &&\n    !hasSkills &&\n    !hasSubagents &&\n    !hasMemory &&\n    !hasStatusline &&\n    !hasActions &&\n    !hasNativeHooks &&\n    !hasConfigPatch\n  ) {\n    throw new ConnectorConfigError(\n      \"a connector must declare at least one of `server`, `hooks`, `commands`, `skills`, `subagents`, `memory`, `statusline`, `actions`, \" +\n        \"or a per-platform `nativeHooks` / `configPatch` declaration\",\n    );\n  }\n\n  if (config.server) {\n    const s = config.server;\n    if (s.transport === \"stdio\") {\n      if (!s.command || typeof s.command !== \"string\") {\n        throw new ConnectorConfigError(\n          \"server.command is required for stdio transport\",\n        );\n      }\n    } else {\n      if (!s.url || typeof s.url !== \"string\") {\n        throw new ConnectorConfigError(\n          `server.url is required for ${s.transport} transport`,\n        );\n      }\n    }\n  }\n\n  // Validate hook handlers are functions, plus any per-host override map.\n  if (config.hooks) {\n    for (const ev of ALL_EVENTS) {\n      const def = config.hooks[ev];\n      if (def != null && typeof def.handler !== \"function\") {\n        throw new ConnectorConfigError(`hooks.${ev}.handler must be a function`);\n      }\n      // Per-host override map: every key must be a registered platform id and\n      // every entry's handler a function (author-time hard error, not skip-warn).\n      validateHostsMap(def?.hosts, `hooks.${ev}.hosts`, \"handler\");\n    }\n  }\n\n  // Validate per-platform native passthrough hooks (handlers live in this same\n  // config module, exactly like normalized hooks — the resolved connector keeps\n  // `platforms` verbatim, so live handlers survive resolution and are recovered\n  // at runtime by re-importing the module via the registry's modulePath).\n  validateNativeHooks(config.platforms);\n\n  // Validate per-platform declarative config patches (pure JSON — persisted\n  // whole; semantics are FIXED set-if-absent/skip-warn, so only the shape is\n  // validated here; the host adapter enforces its sensitive-key denylist).\n  validateConfigPatches(config.platforms);\n\n  const commands = normalizeCommands(config.commands);\n  const skills = normalizeSkills(config.skills);\n  const subagents = normalizeSubagents(config.subagents);\n  const memory = normalizeMemory(config.memory);\n  const statusline = normalizeStatusline(config.statusline);\n  const actions = normalizeActions(config.actions);\n\n  const t = config.telemetry ?? {};\n\n  const resolved: ResolvedConnector = {\n    id: config.id,\n    displayName: config.displayName ?? config.id,\n    version: config.version ?? \"0.0.0\",\n    ...(config.server ? { server: normalizeServer(config.server) } : {}),\n    hooks: config.hooks ?? {},\n    hookEvents: declaredEvents(config.hooks),\n    telemetry: {\n      enabled: t.enabled ?? true,\n      modelFamilyHint: t.modelFamilyHint ?? \"auto\",\n      measureToolDefs: t.measureToolDefs ?? true,\n      // OPT-IN: host-native turn-usage capture is OFF unless explicitly enabled\n      // in config (or forced on at install via AGENT_CONNECTOR_HOST_NATIVE=1).\n      hostNativeUsage: t.hostNativeUsage ?? false,\n      store: t.store ?? \"ndjson\",\n      calibration: {\n        anthropicCountTokens: t.calibration?.anthropicCountTokens ?? false,\n      },\n    },\n    commands,\n    skills,\n    subagents,\n    memory,\n    ...(statusline ? { statusline } : {}),\n    actions,\n    platforms: config.platforms ?? {},\n    targets: config.targets ?? \"auto\",\n    ...(config.publish ? { publish: normalizePublish(config.publish) } : {}),\n  };\n\n  return resolved;\n}\n\n/** The 13 normalized event names, for the nativeHooks collision check. */\nconst NORMALIZED_EVENT_SET: ReadonlySet<string> = new Set(ALL_EVENTS);\n\n/**\n * Validate a per-host override map (`hosts?:`) declared on a hook definition or\n * on the statusline. Shared by the hook-validation loop and normalizeStatusline:\n *   - the value must be a plain object keyed by platform id;\n *   - every key MUST be a REGISTERED platform id (REGISTERED_PLATFORM_IDS) —\n *     an unknown id is an author-time ConnectorConfigError (NOT a skip-warn:\n *     a typo'd host would otherwise silently never fire);\n *   - every entry's implementation field (`handler` for hooks, `render` for\n *     statusline, `run` for actions) MUST be a function (it is re-imported from\n *     the connector module at runtime, like the top-level handler/render/run).\n * `undefined` (no map) is valid and skipped.\n */\nfunction validateHostsMap(\n  map: unknown,\n  surfaceLabel: string,\n  implField: \"handler\" | \"render\" | \"run\",\n): void {\n  if (map == null) return;\n  if (typeof map !== \"object\" || Array.isArray(map)) {\n    throw new ConnectorConfigError(\n      `${surfaceLabel} must be an object keyed by platform id`,\n    );\n  }\n  for (const [platformId, entry] of Object.entries(map as Record<string, unknown>)) {\n    if (!REGISTERED_PLATFORM_IDS.has(platformId as PlatformId)) {\n      const valid = [...REGISTERED_PLATFORM_IDS].sort().join(\", \");\n      throw new ConnectorConfigError(\n        `unknown platform id \"${platformId}\" in hosts map for ${surfaceLabel}; valid ids: ${valid}`,\n      );\n    }\n    if (\n      entry == null ||\n      typeof entry !== \"object\" ||\n      typeof (entry as Record<string, unknown>)[implField] !== \"function\"\n    ) {\n      throw new ConnectorConfigError(\n        `${surfaceLabel}.${platformId}.${implField} must be a function`,\n      );\n    }\n  }\n}\n\n/**\n * Validate every `platforms[<id>].nativeHooks` declaration:\n *   - the value must be an object keyed by HOST-NATIVE event name;\n *   - an event name must NOT collide with the normalized {@link HookEventName}\n *     union (those belong in the cross-platform `hooks` API, which gets\n *     normalization, matcher evaluation, and HookResponse mapping);\n *   - each handler must be a function (it is re-imported from the config module\n *     at runtime, like normalized hook handlers);\n *   - `matcher`, when present, must be a string (written verbatim into the\n *     host's hook config — the host evaluates it).\n */\nfunction validateNativeHooks(platforms: ConnectorConfig[\"platforms\"]): void {\n  if (platforms == null) return;\n  for (const [platformId, override] of Object.entries(platforms)) {\n    const native = override?.nativeHooks;\n    if (native == null) continue;\n    const where = `platforms.${platformId}.nativeHooks`;\n    if (typeof native !== \"object\" || Array.isArray(native)) {\n      throw new ConnectorConfigError(\n        `${where} must be an object keyed by host-native event name`,\n      );\n    }\n    for (const [event, def] of Object.entries(native)) {\n      if (NORMALIZED_EVENT_SET.has(event)) {\n        throw new ConnectorConfigError(\n          `${where}.${event} collides with the normalized hook event \"${event}\"; ` +\n            `declare it under \\`hooks.${event}\\` (the normalized, cross-platform hooks API) instead`,\n        );\n      }\n      if (def == null || typeof def !== \"object\" || typeof def.handler !== \"function\") {\n        throw new ConnectorConfigError(`${where}.${event}.handler must be a function`);\n      }\n      if (def.matcher !== undefined && typeof def.matcher !== \"string\") {\n        throw new ConnectorConfigError(`${where}.${event}.matcher must be a string`);\n      }\n    }\n  }\n}\n\n/**\n * Validate every `platforms[<id>].configPatch` declaration:\n *   - the value must be an array of patch objects;\n *   - `key` must be a dotted LEAF path whose segments match\n *     {@link CONFIG_PATCH_SEGMENT_RE} — no dots-in-key, no array indices;\n *   - `key` must not collide with the agent-connector-modeled namespace\n *     (`hooks*` → hooks/nativeHooks; `mcpServers*` & friends → server/extra);\n *   - duplicate keys within one platform's list are rejected (a duplicate\n *     would double-apply / fight itself on refcounts);\n *   - `value` must be JSON-serializable data (it is persisted whole in the\n *     connector record and in the ownership ledger);\n *   - `reason` is REQUIRED (printed in the install diff and every skip-warn);\n *   - `docsUrl`, when present, must be a string.\n * The HOST-side sensitive-key denylist is deliberately NOT validated here —\n * it lives in (and is documented by) each supporting adapter.\n */\nfunction validateConfigPatches(platforms: ConnectorConfig[\"platforms\"]): void {\n  if (platforms == null) return;\n  for (const [platformId, override] of Object.entries(platforms)) {\n    const patches = override?.configPatch;\n    if (patches == null) continue;\n    const where = `platforms.${platformId}.configPatch`;\n    if (!Array.isArray(patches)) {\n      throw new ConnectorConfigError(`${where} must be an array of patch objects`);\n    }\n    const seen = new Set<string>();\n    patches.forEach((patch, i) => {\n      if (patch == null || typeof patch !== \"object\" || Array.isArray(patch)) {\n        throw new ConnectorConfigError(`${where}[${i}] must be an object`);\n      }\n      if (!isValidConfigPatchKey(patch.key)) {\n        throw new ConnectorConfigError(\n          `${where}[${i}].key must be a dotted LEAF path whose segments match ` +\n            `${CONFIG_PATCH_SEGMENT_RE} (no dots-in-key, no array indices); ` +\n            `got ${JSON.stringify(patch.key)}`,\n        );\n      }\n      const violation = configPatchNamespaceViolation(patch.key);\n      if (violation) {\n        throw new ConnectorConfigError(`${where}[${i}].key ${violation}`);\n      }\n      if (seen.has(patch.key)) {\n        throw new ConnectorConfigError(\n          `${where}[${i}] duplicate key \"${patch.key}\"`,\n        );\n      }\n      seen.add(patch.key);\n      if (!isJsonValue(patch.value)) {\n        throw new ConnectorConfigError(\n          `${where}[${i}].value must be JSON-serializable data ` +\n            `(string/finite number/boolean/null/array/plain object)`,\n        );\n      }\n      if (typeof patch.reason !== \"string\" || patch.reason.trim() === \"\") {\n        throw new ConnectorConfigError(\n          `${where}[${i}].reason is required (a human-readable why, printed in ` +\n            `the install diff and every skip-warn)`,\n        );\n      }\n      if (patch.docsUrl !== undefined && typeof patch.docsUrl !== \"string\") {\n        throw new ConnectorConfigError(`${where}[${i}].docsUrl must be a string`);\n      }\n    });\n  }\n}\n\n/**\n * Validate the optional `publish` block (registry server.json + MCPB bundle\n * distribution metadata). Light, dependency-free: we only reject shapes that\n * would emit a clearly INVALID standard artifact. The per-format required-field\n * checks (e.g. server.json needs registryNamespace, mcpb needs author.name)\n * live in the emitters so a connector that never publishes pays nothing.\n */\nfunction normalizePublish(publish: PublishConfig): PublishConfig {\n  if (typeof publish !== \"object\" || Array.isArray(publish)) {\n    throw new ConnectorConfigError(\"publish must be an object\");\n  }\n  if (publish.registryNamespace !== undefined) {\n    const ns = publish.registryNamespace;\n    if (typeof ns !== \"string\" || !REGISTRY_NAMESPACE_RE.test(ns)) {\n      throw new ConnectorConfigError(\n        `publish.registryNamespace must be a reverse-DNS namespace matching ${REGISTRY_NAMESPACE_RE} ` +\n          `(e.g. \"io.github.acme\" or \"com.acme\"); got ${JSON.stringify(ns)}`,\n      );\n    }\n  }\n  if (publish.packageName !== undefined && typeof publish.packageName !== \"string\") {\n    throw new ConnectorConfigError(\"publish.packageName must be a string\");\n  }\n  if (publish.author !== undefined) {\n    const a = publish.author;\n    if (typeof a !== \"object\" || a == null || typeof a.name !== \"string\" || a.name === \"\") {\n      throw new ConnectorConfigError(\"publish.author.name must be a non-empty string\");\n    }\n  }\n  return { ...publish };\n}\n\n/** Validate a surface name (kebab-case) or throw a ConnectorConfigError. */\nfunction assertSurfaceName(\n  surface: string,\n  name: unknown,\n  index: number,\n  field = \"name\",\n): string {\n  if (typeof name !== \"string\" || !SURFACE_NAME_RE.test(name)) {\n    throw new ConnectorConfigError(\n      `${surface}[${index}].${field} must be kebab-case matching ${SURFACE_NAME_RE} (got ${JSON.stringify(name)})`,\n    );\n  }\n  return name;\n}\n\n/** Require a non-empty string field on a surface entry. */\nfunction assertNonEmptyString(\n  surface: string,\n  index: number,\n  field: string,\n  value: unknown,\n): string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new ConnectorConfigError(`${surface}[${index}].${field} must be a non-empty string`);\n  }\n  return value;\n}\n\n/** Detect a duplicate surface name within one array, throwing on collision. */\nfunction assertNoDuplicate(\n  surface: string,\n  seen: Set<string>,\n  name: string,\n  index: number,\n  field = \"name\",\n): void {\n  if (seen.has(name)) {\n    throw new ConnectorConfigError(`${surface}[${index}] duplicate ${field} \"${name}\"`);\n  }\n  seen.add(name);\n}\n\nfunction normalizeCommands(input: CommandDef[] | undefined): CommandDef[] {\n  if (input == null) return [];\n  if (!Array.isArray(input)) {\n    throw new ConnectorConfigError(\"commands must be an array\");\n  }\n  const seen = new Set<string>();\n  return input.map((cmd, i) => {\n    if (!cmd || typeof cmd !== \"object\") {\n      throw new ConnectorConfigError(`commands[${i}] must be an object`);\n    }\n    const name = assertSurfaceName(\"commands\", cmd.name, i);\n    assertNoDuplicate(\"commands\", seen, name, i);\n    assertNonEmptyString(\"commands\", i, \"prompt\", cmd.prompt);\n    // Pass through verbatim (content); arrays are content, not handlers.\n    return { ...cmd, name };\n  });\n}\n\nfunction normalizeSkills(input: SkillDef[] | undefined): SkillDef[] {\n  if (input == null) return [];\n  if (!Array.isArray(input)) {\n    throw new ConnectorConfigError(\"skills must be an array\");\n  }\n  const seen = new Set<string>();\n  return input.map((skill, i) => {\n    if (!skill || typeof skill !== \"object\") {\n      throw new ConnectorConfigError(`skills[${i}] must be an object`);\n    }\n    const name = assertSurfaceName(\"skills\", skill.name, i);\n    assertNoDuplicate(\"skills\", seen, name, i);\n    const description = assertNonEmptyString(\"skills\", i, \"description\", skill.description);\n    if (description.length > SKILL_DESCRIPTION_MAX) {\n      throw new ConnectorConfigError(\n        `skills[${i}].description exceeds ${SKILL_DESCRIPTION_MAX} chars (got ${description.length})`,\n      );\n    }\n    assertNonEmptyString(\"skills\", i, \"body\", skill.body);\n    assertSafeResourceKeys(\"skills\", i, skill.resources);\n    return { ...skill, name };\n  });\n}\n\n/**\n * Validate every `skill.resources` key as a SAFE relative path that stays inside\n * the skill dir. Each resource is later written/removed via join(skillDir, rel)\n * by every adapter, so an unvalidated key like \"../../settings.json\" would\n * escape the skill dir → arbitrary file write/delete. Reject (throw) when a key\n * is empty/\".\", absolute, or normalizes to a path that begins with \"..\" or\n * contains a \"/..\" (or platform-sep) traversal segment.\n */\nfunction assertSafeResourceKeys(\n  surface: string,\n  index: number,\n  resources: Record<string, string> | undefined,\n): void {\n  if (resources == null) return;\n  if (typeof resources !== \"object\" || Array.isArray(resources)) {\n    throw new ConnectorConfigError(`${surface}[${index}].resources must be an object`);\n  }\n  for (const rel of Object.keys(resources)) {\n    if (rel === \"\" || rel === \".\" || rel.trim() === \"\") {\n      throw new ConnectorConfigError(\n        `${surface}[${index}].resources key must be a non-empty relative path (got ${JSON.stringify(rel)})`,\n      );\n    }\n    if (isAbsolute(rel)) {\n      throw new ConnectorConfigError(\n        `${surface}[${index}].resources key must be a relative path inside the skill dir, not absolute (got ${JSON.stringify(rel)})`,\n      );\n    }\n    // Normalize with BOTH posix and native separators flattened so a Windows\n    // \"..\\\\x\" or a posix \"../x\" is caught regardless of the host OS.\n    const norm = normalize(rel.replace(/\\\\/g, \"/\"));\n    const segs = norm.split(/[/\\\\]/);\n    if (norm === \"..\" || norm.startsWith(\"../\") || norm.startsWith(\"..\\\\\") || segs.includes(\"..\")) {\n      throw new ConnectorConfigError(\n        `${surface}[${index}].resources key must not escape the skill dir via \"..\" (got ${JSON.stringify(rel)})`,\n      );\n    }\n  }\n}\n\n/** Default name for a single-entry memory declaration. */\nconst MEMORY_DEFAULT_NAME = \"memory\";\n\n/**\n * Validate + normalize `memory` entries (the managed-block content surface).\n *   - `name` defaults to \"memory\", then must be kebab-case and unique — it is\n *     half of the block marker id (`<connectorId>/<name>`) and must stay stable;\n *   - `content` must be a non-empty string, ≤ 16 KiB (hard cap — memory files\n *     are injected into every prompt of every session on the host), and must\n *     NOT contain the literal marker tokens `agent-connector:begin` /\n *     `agent-connector:end` (they would corrupt marker scanning in the shared\n *     file — rephrase the guidance instead). The 4 KiB SOFT budget is reported\n *     at install time as a `warn` ChangeRecord, not a config error\n *     (defineConnector has no warning channel).\n */\nfunction normalizeMemory(input: MemoryDef[] | undefined): MemoryDef[] {\n  if (input == null) return [];\n  if (!Array.isArray(input)) {\n    throw new ConnectorConfigError(\"memory must be an array\");\n  }\n  const seen = new Set<string>();\n  return input.map((entry, i) => {\n    if (!entry || typeof entry !== \"object\" || Array.isArray(entry)) {\n      throw new ConnectorConfigError(`memory[${i}] must be an object`);\n    }\n    const name =\n      entry.name === undefined\n        ? MEMORY_DEFAULT_NAME\n        : assertSurfaceName(\"memory\", entry.name, i);\n    assertNoDuplicate(\"memory\", seen, name, i);\n    const content = assertNonEmptyString(\"memory\", i, \"content\", entry.content);\n    const bytes = Buffer.byteLength(content, \"utf8\");\n    if (bytes > MEMORY_CONTENT_HARD_CAP_BYTES) {\n      throw new ConnectorConfigError(\n        `memory[${i}].content exceeds the ${MEMORY_CONTENT_HARD_CAP_BYTES}-byte hard cap ` +\n          `(got ${bytes} bytes); memory is inlined into every prompt of every targeted host — keep it terse`,\n      );\n    }\n    for (const token of [MANAGED_BLOCK_BEGIN_TOKEN, MANAGED_BLOCK_END_TOKEN]) {\n      if (content.includes(token)) {\n        throw new ConnectorConfigError(\n          `memory[${i}].content must not contain the literal marker token \"${token}\" ` +\n            `(it would corrupt managed-block scanning in the shared memory file); rephrase the guidance`,\n        );\n      }\n    }\n    if (entry.description !== undefined && typeof entry.description !== \"string\") {\n      throw new ConnectorConfigError(`memory[${i}].description must be a string`);\n    }\n    return { ...entry, name };\n  });\n}\n\n/** Default name for the (singular) statusline declaration. */\nconst STATUSLINE_DEFAULT_NAME = \"statusline\";\n\n/**\n * Validate + normalize the SINGULAR `statusline` (a HUD handler surface):\n *   - `render` MUST be a function (it is the renderer, re-imported at runtime\n *     like a hook handler);\n *   - `name` defaults to \"statusline\", then must be kebab-case (the shared\n *     surface-name validator);\n *   - `description`, when present, must be a string.\n * Returns undefined when no statusline is declared (it is optional and singular,\n * unlike the memory[] array).\n */\nfunction normalizeStatusline(\n  input: StatuslineDef | undefined,\n): StatuslineDef | undefined {\n  if (input == null) return undefined;\n  if (typeof input !== \"object\" || Array.isArray(input)) {\n    throw new ConnectorConfigError(\"statusline must be an object\");\n  }\n  if (typeof input.render !== \"function\") {\n    throw new ConnectorConfigError(\"statusline.render must be a function\");\n  }\n  const name =\n    input.name === undefined\n      ? STATUSLINE_DEFAULT_NAME\n      : assertSurfaceName(\"statusline\", input.name, 0);\n  if (input.description !== undefined && typeof input.description !== \"string\") {\n    throw new ConnectorConfigError(\"statusline.description must be a string\");\n  }\n  // Per-host render override map: registered platform ids only, each render a\n  // function (author-time hard error, mirroring the hook hosts-map validation).\n  validateHostsMap(input.hosts, \"statusline.hosts\", \"render\");\n  return { ...input, name };\n}\n\n/**\n * Validate + normalize `actions` (the user-invokable action handler surface):\n *   - the value must be an array;\n *   - each entry's `id` must be kebab-case (the shared surface-name validator)\n *     and UNIQUE within the connector (ConnectorConfigError on dup — the id is\n *     the verb's positional arg, so a duplicate would be ambiguous);\n *   - `run` MUST be a function (it is the handler, re-imported at runtime like a\n *     hook handler / statusline render);\n *   - `description`, when present, must be a string;\n *   - the per-host `hosts:` override map is validated via the shared\n *     validateHostsMap (registered platform ids only, each `run` a function).\n * Returns [] when no actions are declared (defaults applied, like the other\n * array surfaces).\n */\nfunction normalizeActions(input: ActionDef[] | undefined): ActionDef[] {\n  if (input == null) return [];\n  if (!Array.isArray(input)) {\n    throw new ConnectorConfigError(\"actions must be an array\");\n  }\n  const seen = new Set<string>();\n  return input.map((action, i) => {\n    if (!action || typeof action !== \"object\" || Array.isArray(action)) {\n      throw new ConnectorConfigError(`actions[${i}] must be an object`);\n    }\n    const id = assertSurfaceName(\"actions\", action.id, i, \"id\");\n    assertNoDuplicate(\"actions\", seen, id, i, \"id\");\n    if (typeof action.run !== \"function\") {\n      throw new ConnectorConfigError(`actions[${i}].run must be a function`);\n    }\n    if (action.description !== undefined && typeof action.description !== \"string\") {\n      throw new ConnectorConfigError(`actions[${i}].description must be a string`);\n    }\n    // Per-host run override map: registered platform ids only, each run a\n    // function (author-time hard error, mirroring the statusline/hook hosts-map).\n    validateHostsMap(action.hosts, `actions.${id}.hosts`, \"run\");\n    return { ...action, id };\n  });\n}\n\n/**\n * Typed identity helper for authoring a status line in its own module:\n *   export const myStatusline = defineStatusline({ render: (ctx) => \"…\" });\n * Mirrors the (informal) defineX helpers; gives the developer full type\n * inference on {@link StatuslineContext} without importing the type by hand.\n */\nexport const defineStatusline = (def: StatuslineDef): StatuslineDef => def;\n\n// ─────────────────────────────────────────────────────────────────────────\n// Typed identity helpers (the `define*` authoring family)\n//\n// Each is a one-line identity function: it returns its argument UNCHANGED and\n// does NOT validate or mutate (validation still happens centrally in\n// defineConnector). Their only job is ergonomics — authoring a surface in its\n// own module with full type inference + autocomplete on the *Def shape, and a\n// single import site — mirroring the existing {@link defineStatusline}.\n// ─────────────────────────────────────────────────────────────────────────\n\n/**\n * Typed identity helper for authoring ONE normalized lifecycle hook in its own\n * module, EVENT-PARAMETERIZED so the handler's payload narrows to that event:\n *\n *   export const onPre = defineHook(\"PreToolUse\", {\n *     handler(evt) { evt.toolName // ← typed as a PreToolUseEvent, not the union\n *       return { decision: \"deny\", reason: \"no\" };\n *     },\n *   });\n *\n * The leading `event` argument exists ONLY to infer `E`; the def is returned\n * unchanged (identity — validation still happens in defineConnector). Passing\n * `HookDefinition` without an event would widen the handler param to the full\n * {@link HookEventName} union and lose per-event narrowing, so the event tag is\n * required.\n */\nexport const defineHook = <E extends HookEventName>(\n  event: E,\n  def: HookDefinition<E>,\n): HookDefinition<E> => {\n  void event; // tag-only: used solely to infer E (the def carries no event field)\n  return def;\n};\n\n/**\n * Typed identity helper for authoring a slash {@link CommandDef} in its own\n * module. Returns the def unchanged (kebab-case name + prompt are validated by\n * defineConnector when the connector is assembled).\n */\nexport const defineCommand = (def: CommandDef): CommandDef => def;\n\n/**\n * Typed identity helper for authoring an Agent {@link SkillDef} in its own\n * module. Returns the def unchanged (name/description/body + safe resource keys\n * are validated by defineConnector).\n */\nexport const defineSkill = (def: SkillDef): SkillDef => def;\n\n/**\n * Typed identity helper for authoring a {@link SubagentDef} in its own module.\n * Returns the def unchanged (name/description/prompt validated by defineConnector).\n */\nexport const defineSubagent = (def: SubagentDef): SubagentDef => def;\n\n/**\n * Typed identity helper for authoring a {@link MemoryDef} (standing-guidance\n * managed block) in its own module. Returns the def unchanged (name/content +\n * byte budget + marker-token guard validated by defineConnector).\n */\nexport const defineMemory = (def: MemoryDef): MemoryDef => def;\n\n/**\n * Typed identity helper for authoring a user-invokable {@link ActionDef} in its\n * own module. Returns the def unchanged (kebab-case unique id + run-is-function\n * + the per-host hosts map validated by defineConnector when the connector is\n * assembled).\n */\nexport const defineAction = (def: ActionDef): ActionDef => def;\n\n/**\n * Typed identity helper for authoring a declarative {@link ConfigPatchDef}\n * (set-if-absent host-config key patch) in its own module. Returns the def\n * unchanged (leaf-path grammar + namespace guard + required reason validated by\n * defineConnector when it appears under `platforms[<id>].configPatch`).\n */\nexport const defineConfigPatch = (def: ConfigPatchDef): ConfigPatchDef => def;\n\n/**\n * Typed identity helper for authoring a {@link NativeHookDef} (host-native\n * passthrough hook) in its own module. Returns the def unchanged (event-name\n * collision + handler-is-function validated by defineConnector when it appears\n * under `platforms[<id>].nativeHooks`).\n */\nexport const defineNativeHook = (def: NativeHookDef): NativeHookDef => def;\n\nfunction normalizeSubagents(input: SubagentDef[] | undefined): SubagentDef[] {\n  if (input == null) return [];\n  if (!Array.isArray(input)) {\n    throw new ConnectorConfigError(\"subagents must be an array\");\n  }\n  const seen = new Set<string>();\n  return input.map((agent, i) => {\n    if (!agent || typeof agent !== \"object\") {\n      throw new ConnectorConfigError(`subagents[${i}] must be an object`);\n    }\n    const name = assertSurfaceName(\"subagents\", agent.name, i);\n    assertNoDuplicate(\"subagents\", seen, name, i);\n    assertNonEmptyString(\"subagents\", i, \"description\", agent.description);\n    assertNonEmptyString(\"subagents\", i, \"prompt\", agent.prompt);\n    return { ...agent, name };\n  });\n}\n\nfunction normalizeServer(server: ConnectorConfig[\"server\"]): ResolvedConnector[\"server\"] {\n  if (!server) return undefined;\n  const wrapDefault = server.transport === \"stdio\";\n  return {\n    ...server,\n    enabled: server.enabled ?? true,\n    tools: server.tools ?? { include: [\"*\"] },\n    wrapForTelemetry: server.wrapForTelemetry ?? wrapDefault,\n  };\n}\n","/**\n * core/mcp-standard — pinned literals + guards for the official MCP standards\n * agent-connector EMITS (registry server.json, MCPB bundle) or SPEAKS (the\n * connection-lifecycle wire used by `doctor --probe`).\n *\n * Each pinned constant is the CURRENT released value verified 2026-06-05 against\n * the upstream spec/schema. They are deliberately centralized + annotated\n * MUST-VERIFY-AT-IMPLEMENTATION: a newer spec revision can supersede any of them\n * without breaking us, so the bump is a one-line change here, never scattered.\n *\n * Sources:\n *  • server.schema.json 2025-12-11 — https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json\n *  • MCPB manifest 0.3 — github.com/anthropics/mcpb (MANIFEST.md)\n *  • MCP protocol 2025-11-25 — modelcontextprotocol.io/specification/2025-11-25\n *    (latest RELEASED revision. 2026-07-28 is a release-candidate only — do NOT\n *    advance to it until it publishes as a stable dated revision. The probe\n *    offers this version but ACCEPTS whatever a server negotiates, so the\n *    offered literal being stale never breaks interop — only this constant.)\n */\n\nimport type { Transport } from \"./types.js\";\n\n/** Registry server.json JSON Schema URL (released 2025-12-11). MUST-VERIFY on bump. */\nexport const MCP_SERVER_SCHEMA_URL =\n  \"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json\";\n\n/** Current MCPB bundle manifest_version (anthropics/mcpb). MUST-VERIFY on bump. */\nexport const MCPB_MANIFEST_VERSION = \"0.3\";\n\n/**\n * Latest RELEASED MCP protocol revision `doctor --probe` offers in `initialize`.\n * Current = 2025-11-25. MUST-VERIFY on bump; stay on the latest *released*\n * revision (2026-07-28 is RC-only as of 2026-06). Negotiation accepts whatever\n * the server returns, so this is the offered value, not a hard requirement.\n */\nexport const MCP_PROTOCOL_VERSION = \"2025-11-25\";\n\n/** Default npm registry base URL stamped into server.json npm packages. */\nexport const NPM_REGISTRY_BASE_URL = \"https://registry.npmjs.org\";\n\n/**\n * server.json transport.type enum — the EXACT values the 2025-12-11 schema\n * accepts (packages[].transport.type and remotes[].type). Our `http` Transport\n * maps to the spec slug \"streamable-http\"; \"ws\" is non-spec (see below).\n */\nexport type RegistryTransportType = \"stdio\" | \"streamable-http\" | \"sse\";\n\n/**\n * Map our {@link Transport} union to the registry/server.json transport slug.\n * Returns null for \"ws\" — WebSocket is NOT a spec transport (it can only exist\n * as a vendor custom transport, e.g. Claude Code's non-spec type:\"ws\"), so a\n * conformant artifact must REJECT it rather than emit an invalid type. The spec\n * defines exactly stdio + streamable-http, with sse the deprecated HTTP+SSE.\n */\nexport function registryTransportType(transport: Transport): RegistryTransportType | null {\n  switch (transport) {\n    case \"stdio\":\n      return \"stdio\";\n    case \"http\":\n      return \"streamable-http\";\n    case \"sse\":\n      return \"sse\";\n    case \"ws\":\n      return null;\n  }\n}\n\n/**\n * Is `v` a CONCRETE version the MCP Registry accepts? The registry rejects\n * ranges (\"^1.2.3\", \"~1.2.3\", \">=1.2.3\", \"1.x\", \"1.*\"); only a pinned SemVer\n * (optionally with a -prerelease / +build suffix) is valid. \"0.0.0\" is concrete\n * (so it passes this guard) but is the unset placeholder — callers warn on it\n * separately via {@link isPlaceholderVersion}.\n */\nexport function isConcreteSemver(v: string): boolean {\n  return /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/.test(v);\n}\n\n/** The unset default version a connector ships with until the dev sets a real one. */\nexport function isPlaceholderVersion(v: string): boolean {\n  return v === \"0.0.0\";\n}\n\n/**\n * Reverse-DNS registry namespace pattern (the part BEFORE the \"/\" in a\n * server.json `name`). The full name regex is\n * `^[a-zA-Z0-9.-]+/[a-zA-Z0-9._-]+$`; the namespace side allows letters, digits,\n * dots and hyphens (NO underscore) — e.g. \"io.github.acme\" or \"com.acme\".\n */\nexport const REGISTRY_NAMESPACE_RE = /^[a-zA-Z0-9.-]+$/;\n\n/** The full server.json `name` regex (namespace \"/\" server-name), per the schema. */\nexport const REGISTRY_NAME_RE = /^[a-zA-Z0-9.-]+\\/[a-zA-Z0-9._-]+$/;\n"],"mappings":";;;;;;;;;;;;;;;;;AAQA,SAAS,YAAY,iBAAiB;;;ACe/B,IAAM,wBACX;AAGK,IAAM,wBAAwB;AAQ9B,IAAM,uBAAuB;AAG7B,IAAM,wBAAwB;AAgB9B,SAAS,sBAAsB,WAAoD;AACxF,UAAQ,WAAW;AAAA,IACjB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;AASO,SAAS,iBAAiB,GAAoB;AACnD,SAAO,2DAA2D,KAAK,CAAC;AAC1E;AAGO,SAAS,qBAAqB,GAAoB;AACvD,SAAO,MAAM;AACf;AAQO,IAAM,wBAAwB;AAG9B,IAAM,mBAAmB;;;ADnDhC,IAAM,QAAQ;AAGd,IAAM,kBAAkB;AAGxB,IAAM,wBAAwB;AAKvB,IAAM,aAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC9C,YAAY,SAAiB;AAC3B,UAAM,6BAA6B,OAAO,EAAE;AAC5C,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,eAAe,OAAiD;AACvE,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,SAAO,WAAW,OAAO,CAAC,MAAM,OAAO,MAAM,CAAC,GAAG,YAAY,UAAU;AACzE;AAMO,SAAS,gBAAgB,QAA4C;AAC1E,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,UAAM,IAAI,qBAAqB,0BAA0B;AAAA,EAC3D;AACA,MAAI,OAAO,OAAO,OAAO,YAAY,CAAC,MAAM,KAAK,OAAO,EAAE,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR,kCAAkC,KAAK,SAAS,KAAK,UAAU,OAAO,EAAE,CAAC;AAAA,IAC3E;AAAA,EACF;AACA,QAAM,cAAc,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,SAAS;AAC/E,QAAM,YAAY,MAAM,QAAQ,OAAO,MAAM,KAAK,OAAO,OAAO,SAAS;AACzE,QAAM,eAAe,MAAM,QAAQ,OAAO,SAAS,KAAK,OAAO,UAAU,SAAS;AAClF,QAAM,YAAY,MAAM,QAAQ,OAAO,MAAM,KAAK,OAAO,OAAO,SAAS;AAIzE,QAAM,gBAAgB,OAAO,cAAc;AAG3C,QAAM,aAAa,MAAM,QAAQ,OAAO,OAAO,KAAK,OAAO,QAAQ,SAAS;AAG5E,QAAM,iBAAiB,OAAO,OAAO,OAAO,aAAa,CAAC,CAAC,EAAE;AAAA,IAC3D,CAAC,aACC,UAAU,eAAe,QAAQ,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS;AAAA,EAChF;AAGA,QAAM,iBAAiB,OAAO,OAAO,OAAO,aAAa,CAAC,CAAC,EAAE;AAAA,IAC3D,CAAC,aAAa,MAAM,QAAQ,UAAU,WAAW,KAAK,SAAS,YAAY,SAAS;AAAA,EACtF;AACA,MACE,CAAC,OAAO,UACR,CAAC,OAAO,SACR,CAAC,eACD,CAAC,aACD,CAAC,gBACD,CAAC,aACD,CAAC,iBACD,CAAC,cACD,CAAC,kBACD,CAAC,gBACD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,MAAI,OAAO,QAAQ;AACjB,UAAM,IAAI,OAAO;AACjB,QAAI,EAAE,cAAc,SAAS;AAC3B,UAAI,CAAC,EAAE,WAAW,OAAO,EAAE,YAAY,UAAU;AAC/C,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AACL,UAAI,CAAC,EAAE,OAAO,OAAO,EAAE,QAAQ,UAAU;AACvC,cAAM,IAAI;AAAA,UACR,8BAA8B,EAAE,SAAS;AAAA,QAC3C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,OAAO;AAChB,eAAW,MAAM,YAAY;AAC3B,YAAM,MAAM,OAAO,MAAM,EAAE;AAC3B,UAAI,OAAO,QAAQ,OAAO,IAAI,YAAY,YAAY;AACpD,cAAM,IAAI,qBAAqB,SAAS,EAAE,6BAA6B;AAAA,MACzE;AAGA,uBAAiB,KAAK,OAAO,SAAS,EAAE,UAAU,SAAS;AAAA,IAC7D;AAAA,EACF;AAMA,sBAAoB,OAAO,SAAS;AAKpC,wBAAsB,OAAO,SAAS;AAEtC,QAAM,WAAW,kBAAkB,OAAO,QAAQ;AAClD,QAAM,SAAS,gBAAgB,OAAO,MAAM;AAC5C,QAAM,YAAY,mBAAmB,OAAO,SAAS;AACrD,QAAM,SAAS,gBAAgB,OAAO,MAAM;AAC5C,QAAM,aAAa,oBAAoB,OAAO,UAAU;AACxD,QAAM,UAAU,iBAAiB,OAAO,OAAO;AAE/C,QAAM,IAAI,OAAO,aAAa,CAAC;AAE/B,QAAM,WAA8B;AAAA,IAClC,IAAI,OAAO;AAAA,IACX,aAAa,OAAO,eAAe,OAAO;AAAA,IAC1C,SAAS,OAAO,WAAW;AAAA,IAC3B,GAAI,OAAO,SAAS,EAAE,QAAQ,gBAAgB,OAAO,MAAM,EAAE,IAAI,CAAC;AAAA,IAClE,OAAO,OAAO,SAAS,CAAC;AAAA,IACxB,YAAY,eAAe,OAAO,KAAK;AAAA,IACvC,WAAW;AAAA,MACT,SAAS,EAAE,WAAW;AAAA,MACtB,iBAAiB,EAAE,mBAAmB;AAAA,MACtC,iBAAiB,EAAE,mBAAmB;AAAA;AAAA;AAAA,MAGtC,iBAAiB,EAAE,mBAAmB;AAAA,MACtC,OAAO,EAAE,SAAS;AAAA,MAClB,aAAa;AAAA,QACX,sBAAsB,EAAE,aAAa,wBAAwB;AAAA,MAC/D;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,IACnC;AAAA,IACA,WAAW,OAAO,aAAa,CAAC;AAAA,IAChC,SAAS,OAAO,WAAW;AAAA,IAC3B,GAAI,OAAO,UAAU,EAAE,SAAS,iBAAiB,OAAO,OAAO,EAAE,IAAI,CAAC;AAAA,EACxE;AAEA,SAAO;AACT;AAGA,IAAM,uBAA4C,IAAI,IAAI,UAAU;AAcpE,SAAS,iBACP,KACA,cACA,WACM;AACN,MAAI,OAAO,KAAM;AACjB,MAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjD,UAAM,IAAI;AAAA,MACR,GAAG,YAAY;AAAA,IACjB;AAAA,EACF;AACA,aAAW,CAAC,YAAY,KAAK,KAAK,OAAO,QAAQ,GAA8B,GAAG;AAChF,QAAI,CAAC,wBAAwB,IAAI,UAAwB,GAAG;AAC1D,YAAM,QAAQ,CAAC,GAAG,uBAAuB,EAAE,KAAK,EAAE,KAAK,IAAI;AAC3D,YAAM,IAAI;AAAA,QACR,wBAAwB,UAAU,sBAAsB,YAAY,gBAAgB,KAAK;AAAA,MAC3F;AAAA,IACF;AACA,QACE,SAAS,QACT,OAAO,UAAU,YACjB,OAAQ,MAAkC,SAAS,MAAM,YACzD;AACA,YAAM,IAAI;AAAA,QACR,GAAG,YAAY,IAAI,UAAU,IAAI,SAAS;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAaA,SAAS,oBAAoB,WAA+C;AAC1E,MAAI,aAAa,KAAM;AACvB,aAAW,CAAC,YAAY,QAAQ,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC9D,UAAM,SAAS,UAAU;AACzB,QAAI,UAAU,KAAM;AACpB,UAAM,QAAQ,aAAa,UAAU;AACrC,QAAI,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AACvD,YAAM,IAAI;AAAA,QACR,GAAG,KAAK;AAAA,MACV;AAAA,IACF;AACA,eAAW,CAAC,OAAO,GAAG,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAI,qBAAqB,IAAI,KAAK,GAAG;AACnC,cAAM,IAAI;AAAA,UACR,GAAG,KAAK,IAAI,KAAK,6CAA6C,KAAK,+BACrC,KAAK;AAAA,QACrC;AAAA,MACF;AACA,UAAI,OAAO,QAAQ,OAAO,QAAQ,YAAY,OAAO,IAAI,YAAY,YAAY;AAC/E,cAAM,IAAI,qBAAqB,GAAG,KAAK,IAAI,KAAK,6BAA6B;AAAA,MAC/E;AACA,UAAI,IAAI,YAAY,UAAa,OAAO,IAAI,YAAY,UAAU;AAChE,cAAM,IAAI,qBAAqB,GAAG,KAAK,IAAI,KAAK,2BAA2B;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;AAkBA,SAAS,sBAAsB,WAA+C;AAC5E,MAAI,aAAa,KAAM;AACvB,aAAW,CAAC,YAAY,QAAQ,KAAK,OAAO,QAAQ,SAAS,GAAG;AAC9D,UAAM,UAAU,UAAU;AAC1B,QAAI,WAAW,KAAM;AACrB,UAAM,QAAQ,aAAa,UAAU;AACrC,QAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,YAAM,IAAI,qBAAqB,GAAG,KAAK,oCAAoC;AAAA,IAC7E;AACA,UAAM,OAAO,oBAAI,IAAY;AAC7B,YAAQ,QAAQ,CAAC,OAAO,MAAM;AAC5B,UAAI,SAAS,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACtE,cAAM,IAAI,qBAAqB,GAAG,KAAK,IAAI,CAAC,qBAAqB;AAAA,MACnE;AACA,UAAI,CAAC,sBAAsB,MAAM,GAAG,GAAG;AACrC,cAAM,IAAI;AAAA,UACR,GAAG,KAAK,IAAI,CAAC,yDACR,uBAAuB,4CACnB,KAAK,UAAU,MAAM,GAAG,CAAC;AAAA,QACpC;AAAA,MACF;AACA,YAAM,YAAY,8BAA8B,MAAM,GAAG;AACzD,UAAI,WAAW;AACb,cAAM,IAAI,qBAAqB,GAAG,KAAK,IAAI,CAAC,SAAS,SAAS,EAAE;AAAA,MAClE;AACA,UAAI,KAAK,IAAI,MAAM,GAAG,GAAG;AACvB,cAAM,IAAI;AAAA,UACR,GAAG,KAAK,IAAI,CAAC,oBAAoB,MAAM,GAAG;AAAA,QAC5C;AAAA,MACF;AACA,WAAK,IAAI,MAAM,GAAG;AAClB,UAAI,CAAC,YAAY,MAAM,KAAK,GAAG;AAC7B,cAAM,IAAI;AAAA,UACR,GAAG,KAAK,IAAI,CAAC;AAAA,QAEf;AAAA,MACF;AACA,UAAI,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,KAAK,MAAM,IAAI;AAClE,cAAM,IAAI;AAAA,UACR,GAAG,KAAK,IAAI,CAAC;AAAA,QAEf;AAAA,MACF;AACA,UAAI,MAAM,YAAY,UAAa,OAAO,MAAM,YAAY,UAAU;AACpE,cAAM,IAAI,qBAAqB,GAAG,KAAK,IAAI,CAAC,4BAA4B;AAAA,MAC1E;AAAA,IACF,CAAC;AAAA,EACH;AACF;AASA,SAAS,iBAAiB,SAAuC;AAC/D,MAAI,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AACzD,UAAM,IAAI,qBAAqB,2BAA2B;AAAA,EAC5D;AACA,MAAI,QAAQ,sBAAsB,QAAW;AAC3C,UAAM,KAAK,QAAQ;AACnB,QAAI,OAAO,OAAO,YAAY,CAAC,sBAAsB,KAAK,EAAE,GAAG;AAC7D,YAAM,IAAI;AAAA,QACR,sEAAsE,qBAAqB,+CAC3C,KAAK,UAAU,EAAE,CAAC;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,gBAAgB,UAAa,OAAO,QAAQ,gBAAgB,UAAU;AAChF,UAAM,IAAI,qBAAqB,sCAAsC;AAAA,EACvE;AACA,MAAI,QAAQ,WAAW,QAAW;AAChC,UAAM,IAAI,QAAQ;AAClB,QAAI,OAAO,MAAM,YAAY,KAAK,QAAQ,OAAO,EAAE,SAAS,YAAY,EAAE,SAAS,IAAI;AACrF,YAAM,IAAI,qBAAqB,gDAAgD;AAAA,IACjF;AAAA,EACF;AACA,SAAO,EAAE,GAAG,QAAQ;AACtB;AAGA,SAAS,kBACP,SACA,MACA,OACA,QAAQ,QACA;AACR,MAAI,OAAO,SAAS,YAAY,CAAC,gBAAgB,KAAK,IAAI,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR,GAAG,OAAO,IAAI,KAAK,KAAK,KAAK,gCAAgC,eAAe,SAAS,KAAK,UAAU,IAAI,CAAC;AAAA,IAC3G;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,qBACP,SACA,OACA,OACA,OACQ;AACR,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,qBAAqB,GAAG,OAAO,IAAI,KAAK,KAAK,KAAK,6BAA6B;AAAA,EAC3F;AACA,SAAO;AACT;AAGA,SAAS,kBACP,SACA,MACA,MACA,OACA,QAAQ,QACF;AACN,MAAI,KAAK,IAAI,IAAI,GAAG;AAClB,UAAM,IAAI,qBAAqB,GAAG,OAAO,IAAI,KAAK,eAAe,KAAK,KAAK,IAAI,GAAG;AAAA,EACpF;AACA,OAAK,IAAI,IAAI;AACf;AAEA,SAAS,kBAAkB,OAA+C;AACxE,MAAI,SAAS,KAAM,QAAO,CAAC;AAC3B,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,qBAAqB,2BAA2B;AAAA,EAC5D;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,MAAM,IAAI,CAAC,KAAK,MAAM;AAC3B,QAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,YAAM,IAAI,qBAAqB,YAAY,CAAC,qBAAqB;AAAA,IACnE;AACA,UAAM,OAAO,kBAAkB,YAAY,IAAI,MAAM,CAAC;AACtD,sBAAkB,YAAY,MAAM,MAAM,CAAC;AAC3C,yBAAqB,YAAY,GAAG,UAAU,IAAI,MAAM;AAExD,WAAO,EAAE,GAAG,KAAK,KAAK;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,gBAAgB,OAA2C;AAClE,MAAI,SAAS,KAAM,QAAO,CAAC;AAC3B,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,qBAAqB,yBAAyB;AAAA,EAC1D;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,MAAM,IAAI,CAAC,OAAO,MAAM;AAC7B,QAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,YAAM,IAAI,qBAAqB,UAAU,CAAC,qBAAqB;AAAA,IACjE;AACA,UAAM,OAAO,kBAAkB,UAAU,MAAM,MAAM,CAAC;AACtD,sBAAkB,UAAU,MAAM,MAAM,CAAC;AACzC,UAAM,cAAc,qBAAqB,UAAU,GAAG,eAAe,MAAM,WAAW;AACtF,QAAI,YAAY,SAAS,uBAAuB;AAC9C,YAAM,IAAI;AAAA,QACR,UAAU,CAAC,yBAAyB,qBAAqB,eAAe,YAAY,MAAM;AAAA,MAC5F;AAAA,IACF;AACA,yBAAqB,UAAU,GAAG,QAAQ,MAAM,IAAI;AACpD,2BAAuB,UAAU,GAAG,MAAM,SAAS;AACnD,WAAO,EAAE,GAAG,OAAO,KAAK;AAAA,EAC1B,CAAC;AACH;AAUA,SAAS,uBACP,SACA,OACA,WACM;AACN,MAAI,aAAa,KAAM;AACvB,MAAI,OAAO,cAAc,YAAY,MAAM,QAAQ,SAAS,GAAG;AAC7D,UAAM,IAAI,qBAAqB,GAAG,OAAO,IAAI,KAAK,+BAA+B;AAAA,EACnF;AACA,aAAW,OAAO,OAAO,KAAK,SAAS,GAAG;AACxC,QAAI,QAAQ,MAAM,QAAQ,OAAO,IAAI,KAAK,MAAM,IAAI;AAClD,YAAM,IAAI;AAAA,QACR,GAAG,OAAO,IAAI,KAAK,0DAA0D,KAAK,UAAU,GAAG,CAAC;AAAA,MAClG;AAAA,IACF;AACA,QAAI,WAAW,GAAG,GAAG;AACnB,YAAM,IAAI;AAAA,QACR,GAAG,OAAO,IAAI,KAAK,mFAAmF,KAAK,UAAU,GAAG,CAAC;AAAA,MAC3H;AAAA,IACF;AAGA,UAAM,OAAO,UAAU,IAAI,QAAQ,OAAO,GAAG,CAAC;AAC9C,UAAM,OAAO,KAAK,MAAM,OAAO;AAC/B,QAAI,SAAS,QAAQ,KAAK,WAAW,KAAK,KAAK,KAAK,WAAW,MAAM,KAAK,KAAK,SAAS,IAAI,GAAG;AAC7F,YAAM,IAAI;AAAA,QACR,GAAG,OAAO,IAAI,KAAK,+DAA+D,KAAK,UAAU,GAAG,CAAC;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AACF;AAGA,IAAM,sBAAsB;AAc5B,SAAS,gBAAgB,OAA6C;AACpE,MAAI,SAAS,KAAM,QAAO,CAAC;AAC3B,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,qBAAqB,yBAAyB;AAAA,EAC1D;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,MAAM,IAAI,CAAC,OAAO,MAAM;AAC7B,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,YAAM,IAAI,qBAAqB,UAAU,CAAC,qBAAqB;AAAA,IACjE;AACA,UAAM,OACJ,MAAM,SAAS,SACX,sBACA,kBAAkB,UAAU,MAAM,MAAM,CAAC;AAC/C,sBAAkB,UAAU,MAAM,MAAM,CAAC;AACzC,UAAM,UAAU,qBAAqB,UAAU,GAAG,WAAW,MAAM,OAAO;AAC1E,UAAM,QAAQ,OAAO,WAAW,SAAS,MAAM;AAC/C,QAAI,QAAQ,+BAA+B;AACzC,YAAM,IAAI;AAAA,QACR,UAAU,CAAC,yBAAyB,6BAA6B,uBACvD,KAAK;AAAA,MACjB;AAAA,IACF;AACA,eAAW,SAAS,CAAC,2BAA2B,uBAAuB,GAAG;AACxE,UAAI,QAAQ,SAAS,KAAK,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR,UAAU,CAAC,wDAAwD,KAAK;AAAA,QAE1E;AAAA,MACF;AAAA,IACF;AACA,QAAI,MAAM,gBAAgB,UAAa,OAAO,MAAM,gBAAgB,UAAU;AAC5E,YAAM,IAAI,qBAAqB,UAAU,CAAC,gCAAgC;AAAA,IAC5E;AACA,WAAO,EAAE,GAAG,OAAO,KAAK;AAAA,EAC1B,CAAC;AACH;AAGA,IAAM,0BAA0B;AAYhC,SAAS,oBACP,OAC2B;AAC3B,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACrD,UAAM,IAAI,qBAAqB,8BAA8B;AAAA,EAC/D;AACA,MAAI,OAAO,MAAM,WAAW,YAAY;AACtC,UAAM,IAAI,qBAAqB,sCAAsC;AAAA,EACvE;AACA,QAAM,OACJ,MAAM,SAAS,SACX,0BACA,kBAAkB,cAAc,MAAM,MAAM,CAAC;AACnD,MAAI,MAAM,gBAAgB,UAAa,OAAO,MAAM,gBAAgB,UAAU;AAC5E,UAAM,IAAI,qBAAqB,yCAAyC;AAAA,EAC1E;AAGA,mBAAiB,MAAM,OAAO,oBAAoB,QAAQ;AAC1D,SAAO,EAAE,GAAG,OAAO,KAAK;AAC1B;AAgBA,SAAS,iBAAiB,OAA6C;AACrE,MAAI,SAAS,KAAM,QAAO,CAAC;AAC3B,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,qBAAqB,0BAA0B;AAAA,EAC3D;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,MAAM,IAAI,CAAC,QAAQ,MAAM;AAC9B,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,YAAM,IAAI,qBAAqB,WAAW,CAAC,qBAAqB;AAAA,IAClE;AACA,UAAM,KAAK,kBAAkB,WAAW,OAAO,IAAI,GAAG,IAAI;AAC1D,sBAAkB,WAAW,MAAM,IAAI,GAAG,IAAI;AAC9C,QAAI,OAAO,OAAO,QAAQ,YAAY;AACpC,YAAM,IAAI,qBAAqB,WAAW,CAAC,0BAA0B;AAAA,IACvE;AACA,QAAI,OAAO,gBAAgB,UAAa,OAAO,OAAO,gBAAgB,UAAU;AAC9E,YAAM,IAAI,qBAAqB,WAAW,CAAC,gCAAgC;AAAA,IAC7E;AAGA,qBAAiB,OAAO,OAAO,WAAW,EAAE,UAAU,KAAK;AAC3D,WAAO,EAAE,GAAG,QAAQ,GAAG;AAAA,EACzB,CAAC;AACH;AAQO,IAAM,mBAAmB,CAAC,QAAsC;AA4BhE,IAAM,aAAa,CACxB,OACA,QACsB;AACtB,OAAK;AACL,SAAO;AACT;AAOO,IAAM,gBAAgB,CAAC,QAAgC;AAOvD,IAAM,cAAc,CAAC,QAA4B;AAMjD,IAAM,iBAAiB,CAAC,QAAkC;AAO1D,IAAM,eAAe,CAAC,QAA8B;AAQpD,IAAM,eAAe,CAAC,QAA8B;AAQpD,IAAM,oBAAoB,CAAC,QAAwC;AAQnE,IAAM,mBAAmB,CAAC,QAAsC;AAEvE,SAAS,mBAAmB,OAAiD;AAC3E,MAAI,SAAS,KAAM,QAAO,CAAC;AAC3B,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,UAAM,IAAI,qBAAqB,4BAA4B;AAAA,EAC7D;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,MAAM,IAAI,CAAC,OAAO,MAAM;AAC7B,QAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,YAAM,IAAI,qBAAqB,aAAa,CAAC,qBAAqB;AAAA,IACpE;AACA,UAAM,OAAO,kBAAkB,aAAa,MAAM,MAAM,CAAC;AACzD,sBAAkB,aAAa,MAAM,MAAM,CAAC;AAC5C,yBAAqB,aAAa,GAAG,eAAe,MAAM,WAAW;AACrE,yBAAqB,aAAa,GAAG,UAAU,MAAM,MAAM;AAC3D,WAAO,EAAE,GAAG,OAAO,KAAK;AAAA,EAC1B,CAAC;AACH;AAEA,SAAS,gBAAgB,QAAgE;AACvF,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,cAAc,OAAO,cAAc;AACzC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,OAAO,WAAW;AAAA,IAC3B,OAAO,OAAO,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE;AAAA,IACxC,kBAAkB,OAAO,oBAAoB;AAAA,EAC/C;AACF;","names":[]}