@keystrokehq/cli 0.0.110 → 0.0.112

package/dist/skills-bundle/_AGENTS.md

@@ -68,6 +68,15 @@ Default-export each module — the server discovers files under `src/`.
 
 **Actions are leaf units.** An action never calls another action (including integration actions like `postMessage`). Compose actions in a workflow, or attach an integration action directly as a workflow step / agent tool. An action may call an agent.
 
+## Working habits
+
+A few things that are easy to skip and cause common failures:
+
+- **Research real APIs before mirroring them** — web search and fetch the actual reference & explore relevant docs; don't guess endpoints or payload shapes.
+- **Run before you depend or deploy** — run the workflow/agent locally and read the real output (`keystroke workflow runs get <key> <run-id> --include steps,trace`) before wiring dependent steps.
+- **Cover obvious edge cases** and write simple tests as needed (null field, empty array, a step that throws) — see [workflows skill](.agents/skills/keystroke-workflows/SKILL.md).
+- **Cloud creds aren't in `.env`** — `keystroke deploy` never uploads `.env`; credentials that run in the cloud must be set against the cloud target. See [credentials skill](.agents/skills/keystroke-credentials/SKILL.md).
+
 ## Audit & debug (CLI)
 
 Use the CLI against the correct target — do not call HTTP directly.

package/dist/skills-bundle/skills/keystroke-agents/SKILL.md

@@ -20,7 +20,7 @@ import { exaSearch, exaAnswer } from "@keystrokehq/exa/actions";
 export default defineAgent(
   {
     systemPrompt: "Research signups with Exa. Stay concise; cite sources.",
-    model: { provider: "anthropic", id: "claude-sonnet-4-6" },
+    model: "anthropic/claude-sonnet-4-6",
     tools: [exaSearch, exaAnswer],
   },
   { key: "signup-researcher", module: import.meta.url },

package/dist/skills-bundle/skills/keystroke-agents/references/models.md

@@ -1,18 +1,25 @@
 # Models
 
 ```ts
-model: { provider: "anthropic", id: "claude-sonnet-4-6" }
-thinkingLevel: "high" // optional — defaults to "medium"; use "off" to disable reasoning
+model: "google/gemini-2.5-flash"; // vendor/model-id — any pi-ai or gateway catalog id
+thinkingLevel: "high"; // optional — defaults to "medium"; use "off" to disable reasoning
 ```
 
 Per-prompt override via API: `{ "message": "...", "thinkingLevel": "low" }`.
 
-Set provider API keys in `.env` (e.g. `ANTHROPIC_API_KEY`).
+**Local dev (direct)** — set the provider key for each vendor you use (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, …). Only models in the pi-ai direct registry resolve without gateway.
 
-| Use case       | Tip                                               |
-| -------------- | ------------------------------------------------- |
-| General agents | `claude-sonnet-4-6` or your provider's fast model |
-| Heavy tool use | Strong tool-use model + focused system prompt     |
-| Cost in dev    | Cheaper model id in local `.env` only             |
+**Optional gateway** — set `AI_GATEWAY_API_KEY` to route all agents through Vercel AI Gateway with the same model string. Unlocks gateway-only ids (e.g. `moonshotai/kimi-k2`, `deepseek/deepseek-v3`, `zai/glm-4.5`).
+
+**Cloud** — hosted workers use the platform LLM proxy automatically; no provider keys in the container.
+
+| Vendor    | Example id                    | Direct key          |
+| --------- | ----------------------------- | ------------------- |
+| Anthropic | `anthropic/claude-sonnet-4.5` | `ANTHROPIC_API_KEY` |
+| OpenAI    | `openai/gpt-5.5`              | gateway only        |
+| Google    | `google/gemini-3.5-flash`     | gateway only        |
+| DeepSeek  | `deepseek/deepseek-v3`        | gateway only        |
+| Moonshot  | `moonshotai/kimi-k2.5`        | gateway only        |
+| Zhipu GLM | `zai/glm-4.5`                 | gateway only        |
 
 After changing model, smoke-test: `keystroke agent prompt <key> --message "Hi"`.

package/dist/skills-bundle/skills/keystroke-credentials/SKILL.md

@@ -1,30 +1,55 @@
 ---
 name: keystroke-credentials
-description: Manage keystroke credentials — vault secrets, OAuth via integration plugins, keystroke connect and credentials CLI. Use when wiring Exa, Google, Slack, or custom API keys.
+description: Manage keystroke credentials — vault API keys and OAuth via keystroke credentials / keystroke connect, scopes, and getting creds into the cloud. Use when wiring Exa, Google, Slack, or custom API keys, and when a deployed run fails with missing credentials.
 metadata:
   keystroke-domain: credentials
 ---
 
 # Credentials
 
-Secrets live in the **server vault** and OAuth stores — not in source.
+Secrets live in a **credential store** (vault for API keys, OAuth stores for tokens) — never in source.
 
-## Enable integrations
+There are **two separate stores**: your **local** keystroke server and the **cloud** platform. `keystroke deploy` uploads your built code only — it never copies `.env` or local credentials. Provision creds for **every target you run on**.
 
-```ts
-// keystroke.config.ts
-import { defineConfig } from "@keystrokehq/config";
-import { googleManaged } from "@keystrokehq/google";
-import { slackManaged } from "@keystrokehq/slack";
+## `.env` vs the credential store
 
-export default defineConfig({
-  plugins: [slackManaged(), googleManaged()],
-});
+| Holds                                                                                                             | `.env`                | Credential store        |
+| ----------------------------------------------------------------------------------------------------------------- | --------------------- | ----------------------- |
+| Model keys (`ANTHROPIC_API_KEY`), DB URL, OAuth **app** config (`SLACK_CLIENT_ID`, `GOOGLE_*`, `SLACK_BOT_TOKEN`) | yes — local boot only | —                       |
+| API-key + OAuth credential **instances** resolved by actions at runtime                                           | —                     | yes                     |
+| Reaches the cloud?                                                                                                | no                    | yes, when set vs. cloud |
+
+The local server reads `.env` at boot; OAuth **app** env auto-seeds the local OAuth app so you can `connect`. **API-key credentials (Exa, custom) are not read from `.env`** — create them with `keystroke credentials set`.
+
+## Scopes — default to `project`
+
+A credential is stored at one scope:
+
+| Scope                 | CLI                                 | Means                                                                                                        |
+| --------------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------ |
+| **project** (default) | `--scope project --project-id <id>` | Tied to one project. **Use this unless told otherwise** — you're provisioning the project you're working in. |
+| **org**               | `--scope org`                       | Shared by **every user and project in the org**. Only set org scope when the user explicitly asks for it.    |
+| **user**              | `--scope user`                      | A single user's personal credential — a different use case, not project/deploy setup.                        |
+
+`--scope` is required (there is no implicit default), so always pass it — pick `project` by default. Get the active project id from `keystroke config show`.
+
+At runtime an action resolves a credential by checking the **org** scope first, then the **project** scope.
+
+## Set an API key
+
+```bash
+# default: scope to the project you're deploying; read the value from your shell / .env
+keystroke credentials set exa --scope project --project-id <id> --set apiKey=@env:EXA_API_KEY
+
+# or paste the value directly
+keystroke credentials set exa --scope project --project-id <id> --set apiKey=sk-...
 ```
 
-Set provider env vars in `.env` (app ids, secrets, API keys). Model keys like `ANTHROPIC_API_KEY` also go in `.env`.
+- The field name (`apiKey`) comes from the integration's `defineCredential`.
+- `@env:VAR` reads from your shell or project `.env`.
+- `set` always creates a **new** instance. To change an existing one: `keystroke credentials update <id>`. A second instance in the same scope needs `--label <name>` (and `--default` to pick the one to resolve).
 
-## OAuth connect
+## Connect OAuth (Google, Slack, etc)
 
 ```bash
 keystroke auth login
@@ -32,13 +57,26 @@ keystroke connect google
 keystroke connect slack
 ```
 
-## Manual vault secrets
+`connect` completes the browser flow and stores the OAuth token in the active target's store, ready for any action that uses that integration. Run it against each target you deploy to.
+
+## Targets: local vs cloud
+
+`keystroke credentials` and `keystroke connect` follow the active runtime, exactly like other commands: **local** while `keystroke dev` runs or after `config use local`; the **deployed project** after `config use cloud` or with `--project`. A credential set locally does not exist in the cloud, and vice versa. See [cli skill](.agents/skills/keystroke-cli/SKILL.md).
+
+## Before deploy: provision the cloud
+
+The cloud store starts **empty**. After the first deploy:
 
 ```bash
-keystroke credentials list
-keystroke credentials set exa-api-key --value '...'
+keystroke deploy --project <id>          # uploads code only — no creds, no .env
+keystroke config use cloud               # target the deployed project
+keystroke connect google                 # OAuth against cloud
+keystroke credentials set exa --scope project --project-id <id> --set apiKey=@env:EXA_API_KEY
+keystroke credentials list               # verify against the active (cloud) target
 ```
 
+A missing-credential error on a deployed run almost always means a credential set locally was never set in the cloud.
+
 ## Use in actions
 
 ```ts
@@ -53,18 +91,18 @@ export const notify = defineAction({
 });
 ```
 
-Integration actions (Exa search, Gmail send, Slack post) resolve credentials automatically when the plugin is configured.
+Integration actions (Exa search, Gmail send, Slack post) resolve credentials automatically from the active target's store when the plugin is configured.
 
 ## Audit
 
 ```bash
-keystroke credentials list
+keystroke credentials list   # instances for the active target
 ```
 
-Failed integration calls → check missing env vars, OAuth not completed, or wrong credential key on the action.
+Failed integration call → confirm you are on the right target (`keystroke config show`), the credential exists **for that target and scope**, OAuth was completed, and the action declares the right credential key.
 
 ## Next references
 
-- [cli-and-oauth.md](references/cli-and-oauth.md) — auth, connect, dashboard
+- [cli-and-oauth.md](references/cli-and-oauth.md) — auth, connect, local vs cloud stores
 
-Related: [actions](.agents/skills/keystroke-actions/SKILL.md), [gateways](.agents/skills/keystroke-gateways/SKILL.md).
+Related: [cli](.agents/skills/keystroke-cli/SKILL.md), [actions](.agents/skills/keystroke-actions/SKILL.md), [gateways](.agents/skills/keystroke-gateways/SKILL.md).

package/dist/skills-bundle/skills/keystroke-credentials/references/cli-and-oauth.md

@@ -16,22 +16,36 @@ keystroke connect google
 keystroke connect slack
 ```
 
-Complete the browser flow once per provider. Tokens are stored server-side.
+Complete the browser flow once per provider. The token is stored server-side in the active target's store, ready for actions that use the integration. Run `connect` against each target you deploy to.
 
-## Manual secrets
+## Set an API key
 
-For API keys that are not OAuth (e.g. Exa):
+For API keys that are not OAuth (e.g. Exa). The field name (`apiKey`) comes from the integration's `defineCredential`:
 
 ```bash
-keystroke credentials set exa-api-key --value '...'
+# default to project scope — provision the project you're working in
+keystroke credentials set exa --scope project --project-id <id> --set apiKey=@env:EXA_API_KEY
 keystroke credentials list
 ```
 
-## `.env` vs vault
+`--scope` is required; there is no implicit default, so always pass it:
 
-| Store         | For                                                                                  |
-| ------------- | ------------------------------------------------------------------------------------ |
-| `.env`        | Server bootstrap — `ANTHROPIC_API_KEY`, Slack app id/secret, database URL            |
-| Vault / OAuth | Per-user or per-workspace tokens via `keystroke credentials` and `keystroke connect` |
+| Scope               | When                                                                         |
+| ------------------- | ---------------------------------------------------------------------------- |
+| `project` (default) | Tie the credential to one project — use this unless told otherwise.          |
+| `org`               | Share with **every user and project** in the org — only on explicit request. |
+| `user`              | A single user's personal credential — different use case.                    |
+
+`set` always creates a new instance; use `keystroke credentials update <id>` to change one, and `--label <name>` to add a second in the same scope. At runtime a credential resolves **org first, then project**.
+
+## `.env` vs the credential store
+
+| Holds                                                                                          | `.env`                | Credential store        |
+| ---------------------------------------------------------------------------------------------- | --------------------- | ----------------------- |
+| Model keys (`ANTHROPIC_API_KEY`), DB URL, OAuth **app** config (`SLACK_CLIENT_ID`, `GOOGLE_*`) | yes — local boot only | —                       |
+| API-key + OAuth credential instances resolved at runtime                                       | —                     | yes                     |
+| Reaches the cloud?                                                                             | no                    | yes, when set vs. cloud |
+
+API-key credentials are **not** read from `.env` — create them with `keystroke credentials set`. `keystroke credentials` / `keystroke connect` target the **active** runtime (local while `keystroke dev` runs or after `config use local`; cloud after deploy / `config use cloud` / `--project`). The stores are independent; `keystroke deploy` never copies `.env` or local credentials, so re-provision against the cloud target after deploy.
 
 Dashboard at `:3000` can also manage credentials and gateway attachments.

package/dist/templates/hello-world/src/agents/hello.ts

@@ -3,7 +3,7 @@ import { defineAgent } from "@keystrokehq/keystroke/agent";
 export default defineAgent(
   {
     systemPrompt: "You are a friendly hello-world agent. Keep replies short.",
-    model: { provider: "anthropic", id: "claude-sonnet-4-6" },
+    model: "anthropic/claude-sonnet-4-6",
   },
   { key: "hello", module: import.meta.url },
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keystrokehq/cli",
-  "version": "0.0.110",
+  "version": "0.0.112",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/dallinbentley/keystroke.git",

package/dist/dist-D1ip549D.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"dist-D1ip549D.mjs","names":["z.object","z.string","z.array"],"sources":["../../../packages/server/dist/discovery-XqwkB9H_.mjs","../../../packages/sandbox/dist/files-B0H9_dP4.mjs","../../../packages/tsdown-config/deps.js","../../../packages/tsdown-config/index.js","../../../packages/build/dist/index.mjs"],"sourcesContent":["import { relative, sep } from \"node:path\";\n//#region src/discovery/entry-from-file.ts\nconst SOURCE_EXT = /\\.(ts|mts|mjs|js)$/;\nconst DECLARATION_FILE = /\\.d\\.(ts|mts|cts)$/;\nfunction entryIdFromFile(rootDir, filePath, options) {\n\tif (DECLARATION_FILE.test(filePath)) return null;\n\tconst baseName = filePath.split(sep).at(-1) ?? \"\";\n\tif (/\\.(int\\.)?test\\.(ts|mts)$/.test(baseName)) return null;\n\tconst segments = relative(rootDir, filePath).replace(SOURCE_EXT, \"\").split(sep).filter((segment) => segment.length > 0);\n\tif (segments.length === 1) return segments[0] ?? null;\n\tconst last = segments.at(-1);\n\tconst entryNames = new Set([options.nestedEntry]);\n\tif (options.allowIndex !== false) entryNames.add(\"index\");\n\tif (!last || !entryNames.has(last)) return null;\n\tconst id = segments.slice(0, -1).join(\"/\");\n\treturn id.length > 0 ? id : null;\n}\n//#endregion\nexport { entryIdFromFile as t };\n\n//# sourceMappingURL=discovery-XqwkB9H_.mjs.map","import { basename, dirname, join, relative, resolve } from \"node:path\";\nimport { access, mkdir, writeFile } from \"node:fs/promises\";\nimport { z } from \"zod\";\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n//#region src/sandbox-dirs.ts\nfunction resolveSandboxRoot(workspacesRoot, scope) {\n\tif (scope.type === \"agent\") return join(workspacesRoot, scope.agentId);\n\treturn join(workspacesRoot, \"runs\", scope.runId);\n}\nasync function ensureWorkspaceDir(workspaceRoot) {\n\tawait mkdir(workspaceRoot, { recursive: true });\n}\n//#endregion\n//#region src/files/schemas.ts\nconst SandboxFileContentSchema = z.object({\n\tpath: z.string(),\n\tfile: z.string()\n});\n/** Destination path under `/workspace`. For `dir`, used as a prefix. */\nconst SandboxFileSchema = z.object({\n\tpath: z.string(),\n\t/** Single file body — typically from a build-time import (`import doc from \"./doc.md\"`). */\n\tfile: z.string().optional(),\n\t/** Directory contents — each path is relative to `path`. */\n\tdir: z.array(SandboxFileContentSchema).optional()\n});\nconst SandboxDefinitionSchema = z.object({\n\tkey: z.string().optional(),\n\tfiles: z.array(SandboxFileSchema).optional()\n});\n//#endregion\n//#region src/files/define-sandbox.ts\n/** Define a reusable sandbox file layout. */\nfunction defineSandbox(def) {\n\treturn def;\n}\n//#endregion\n//#region src/files/flatten-sandbox-files.ts\n/** Expand directory entries into flat `{ path, file }` records under `/workspace`. */\nfunction flattenSandboxFiles(files) {\n\tif (!files?.length) return [];\n\tconst flattened = [];\n\tfor (const entry of files) {\n\t\tif (entry.dir !== void 0) {\n\t\t\tconst prefix = entry.path.replace(/\\/+$/, \"\");\n\t\t\tfor (const child of entry.dir) flattened.push({\n\t\t\t\tpath: prefix ? `${prefix}/${child.path}` : child.path,\n\t\t\t\tfile: child.file\n\t\t\t});\n\t\t\tcontinue;\n\t\t}\n\t\tif (entry.file === void 0) continue;\n\t\tflattened.push({\n\t\t\tpath: entry.path,\n\t\t\tfile: entry.file\n\t\t});\n\t}\n\treturn flattened;\n}\n//#endregion\n//#region src/files/materialize-sandbox.ts\nasync function materializeSandbox(options) {\n\tconst root = resolveSandboxRoot(options.workspacesRoot, options.scope);\n\tawait ensureWorkspaceDir(root);\n\tconst files = flattenSandboxFiles(options.definition?.files);\n\tif (files.length) await applySandboxFiles(root, files, options.scope);\n\treturn {\n\t\troot,\n\t\tscope: options.scope,\n\t\t...options.definition !== void 0 ? { definition: options.definition } : {}\n\t};\n}\nasync function applySandboxFiles(root, files, scope) {\n\tfor (const entry of files) {\n\t\tconst hostPath = resolve(root, entry.path);\n\t\tif (scope.type === \"agent\") try {\n\t\t\tawait access(hostPath);\n\t\t\tcontinue;\n\t\t} catch {}\n\t\tawait mkdir(dirname(hostPath), { recursive: true });\n\t\tawait writeFile(hostPath, entry.file);\n\t}\n}\n//#endregion\n//#region src/files/pack-dir.ts\nconst SKIP_DIRS$1 = new Set([\".git\", \"node_modules\"]);\n/** Recursively read a host file or directory into sandbox-relative `{ path, file }` entries. */\nfunction packDirFromDisk(rootPath) {\n\tconst stat = statSync(rootPath);\n\tif (stat.isFile()) return [{\n\t\tpath: basename(rootPath),\n\t\tfile: readFileSync(rootPath, \"utf8\")\n\t}];\n\tif (!stat.isDirectory()) throw new Error(`Expected a file or directory at ${rootPath}`);\n\tconst files = [];\n\twalkDir(rootPath, rootPath, files);\n\treturn files;\n}\nfunction walkDir(rootPath, currentPath, files) {\n\tfor (const name of readdirSync(currentPath)) {\n\t\tif (SKIP_DIRS$1.has(name)) continue;\n\t\tconst entryPath = join(currentPath, name);\n\t\tconst stat = statSync(entryPath);\n\t\tif (stat.isDirectory()) {\n\t\t\twalkDir(rootPath, entryPath, files);\n\t\t\tcontinue;\n\t\t}\n\t\tif (!stat.isFile()) continue;\n\t\tfiles.push({\n\t\t\tpath: relative(rootPath, entryPath),\n\t\t\tfile: readFileSync(entryPath, \"utf8\")\n\t\t});\n\t}\n}\n//#endregion\n//#region src/files/pack-asset-dirs.ts\nconst SKIP_DIRS = new Set([\".git\", \"node_modules\"]);\n/** Pack every subdir under `src/skills/` and `src/files/` into an asset manifest. */\nfunction packAssetDirs(appRoot, srcDir = \"src\") {\n\treturn {\n\t\tskills: packAssetRoot(join(appRoot, srcDir, \"skills\")),\n\t\tfiles: packAssetRoot(join(appRoot, srcDir, \"files\"))\n\t};\n}\nfunction packAssetRoot(rootPath) {\n\tif (!statSync(rootPath, { throwIfNoEntry: false })?.isDirectory()) return {};\n\tconst manifest = {};\n\tfor (const name of readdirSync(rootPath)) {\n\t\tif (SKIP_DIRS.has(name)) continue;\n\t\tconst entryPath = join(rootPath, name);\n\t\tif (!statSync(entryPath).isDirectory()) continue;\n\t\tmanifest[name] = packDirFromDisk(entryPath);\n\t}\n\treturn manifest;\n}\n//#endregion\n//#region src/files/resolve-app-root.ts\n/** Walk upward from a module file to find the user app root (`src/agents`, `src/skills`, etc.). */\nfunction resolveAppRoot(fromPath) {\n\tlet dir = statSync(fromPath).isDirectory() ? fromPath : dirname(fromPath);\n\twhile (dir !== dirname(dir)) {\n\t\tif (hasAppLayout(dir)) return dir;\n\t\tdir = dirname(dir);\n\t}\n\treturn process.env.KEYSTROKE_ROOT ?? process.cwd();\n}\n/** Resolve app root from an agent (or other) module URL. */\nfunction resolveAppRootFromModule(moduleUrl) {\n\treturn resolveAppRoot(fileURLToPath(moduleUrl));\n}\nfunction hasAppLayout(dir) {\n\tconst src = join(dir, \"src\");\n\tconst dist = join(dir, \"dist\");\n\treturn existsSync(join(src, \"agents\")) || existsSync(join(src, \"skills\")) || existsSync(join(src, \"files\")) || existsSync(join(dist, \"agents\")) || existsSync(join(dist, \".keystroke\", \"assets.mjs\"));\n}\n//#endregion\nexport { materializeSandbox as a, SandboxDefinitionSchema as c, ensureWorkspaceDir as d, resolveSandboxRoot as f, packDirFromDisk as i, SandboxFileContentSchema as l, resolveAppRootFromModule as n, flattenSandboxFiles as o, packAssetDirs as r, defineSandbox as s, resolveAppRoot as t, SandboxFileSchema as u };\n\n//# sourceMappingURL=files-B0H9_dP4.mjs.map","import { isBuiltin } from \"node:module\";\n\n/** Native addons kept external — resolved from the CLI runtime at app start. */\nexport const NATIVE_RUNTIME_DEPS = [\"pg\", \"better-sqlite3\", \"@parcel/watcher\"];\n\n/** Kept external so .d.ts emission does not inline internal/inferred types. */\nexport const LIBRARY_EXTERNAL_DEPS = [\"better-auth\", /^@better-auth\\//, /^better-auth\\//];\n\n/** Non-auth runtime deps kept external for published entry bundles (platform, etc.). */\nexport const BUNDLED_ENTRY_RUNTIME_EXTERNAL_DEPS = [\n  ...NATIVE_RUNTIME_DEPS,\n  \"dockerode\",\n  \"ssh2\",\n  \"cpu-features\",\n  \"microsandbox\",\n  /^@aws-sdk\\//,\n  /^@napi-rs\\//,\n  \"hono\",\n  /^@hono\\//,\n  \"undici\",\n];\n\n/** Kept external when bundling published entry points (cli, keystroke, platform). */\nexport const BUNDLED_ENTRY_EXTERNAL_DEPS = [\n  ...BUNDLED_ENTRY_RUNTIME_EXTERNAL_DEPS,\n  ...LIBRARY_EXTERNAL_DEPS,\n];\n\n/** Bundle into CLI — device login uses Better Auth client only. */\nexport const BETTER_AUTH_CLIENT_BUNDLE_PATTERNS = [\n  /^better-auth\\/client$/,\n  /^better-auth\\/client\\//,\n];\n\n/** Server adapters and root entry — must not ship in the CLI bundle. */\nexport const BETTER_AUTH_SERVER_EXTERNAL_PATTERNS = [\n  /^better-auth$/,\n  /^@better-auth\\//,\n  /^better-auth\\/(?!client(\\/|$)).+/,\n];\n\nexport function isNativeRuntimeDep(id) {\n  return NATIVE_RUNTIME_DEPS.some((dep) => id === dep || id.startsWith(`${dep}/`));\n}\n\nfunction packageName(id) {\n  if (id.startsWith(\"@\")) {\n    const [scope, name] = id.split(\"/\");\n    return name ? `${scope}/${name}` : id;\n  }\n\n  return id.split(\"/\")[0] ?? id;\n}\n\nfunction isRuntimeExternal(id) {\n  const name = packageName(id);\n  if (isNativeRuntimeDep(name)) {\n    return true;\n  }\n\n  if (name.startsWith(\"@keystrokehq/\")) {\n    return true;\n  }\n\n  if (name === \"better-auth\" || name.startsWith(\"@better-auth/\")) {\n    return true;\n  }\n\n  return false;\n}\n\n/** Library packages resolve npm deps from node_modules at runtime. */\nexport function libraryBuildDepsConfig() {\n  return {\n    alwaysBundle: (_id) => null,\n    neverBundle: [...NATIVE_RUNTIME_DEPS, /^@keystrokehq\\//, ...LIBRARY_EXTERNAL_DEPS],\n    onlyBundle: false,\n  };\n}\n\n/** Bundle npm deps into dist; resolve @keystrokehq/* and natives from the runtime. */\nexport function userAppBuildDepsConfig() {\n  return {\n    alwaysBundle: (id, _importer) => {\n      if (id.startsWith(\".\") || id.startsWith(\"/\") || isBuiltin(id)) {\n        return null;\n      }\n\n      return isRuntimeExternal(id) ? null : true;\n    },\n    neverBundle: [...NATIVE_RUNTIME_DEPS, /^@keystrokehq\\//, ...LIBRARY_EXTERNAL_DEPS],\n    onlyBundle: false,\n  };\n}\n\n/**\n * Published entry packages (cli, keystroke, platform): declare bundled @keystrokehq/*\n * in dependencies (changesets release graph ignores devDependencies). Inlining is\n * driven by alwaysBundle below, not by dep kind. Runtime npm deps stay external.\n */\nexport function bundledEntryDepsConfig() {\n  return {\n    alwaysBundle: [/^@keystrokehq\\//],\n    neverBundle: [...BUNDLED_ENTRY_EXTERNAL_DEPS],\n    onlyBundle: false,\n  };\n}\n\n/** Published CLI: inline better-auth client + @better-auth/*; keep server adapters external. */\nexport const BETTER_AUTH_CLI_BUNDLE_PATTERNS = [\n  ...BETTER_AUTH_CLIENT_BUNDLE_PATTERNS,\n  /^@better-auth\\//,\n];\n\nexport const BETTER_AUTH_CLI_EXTERNAL_PATTERNS = [\n  /^better-auth$/,\n  /^better-auth\\/(?!client(\\/|$)).+/,\n  /^@better-auth\\/drizzle-adapter/,\n  \"drizzle-orm\",\n];\n\n/** Rolldown/tsdown — native bindings; stay in CLI node_modules at runtime. */\nexport const CLI_BUILD_TOOL_EXTERNAL_PATTERNS = [\"tsdown\", \"rolldown\", /^@rolldown\\//, \"tsx\"];\n\n/** CLI: inline better-auth/client; keep server + drizzle adapters external. */\nexport function cliBundledEntryDepsConfig() {\n  return {\n    alwaysBundle: [/^@keystrokehq\\//, ...BETTER_AUTH_CLI_BUNDLE_PATTERNS],\n    neverBundle: [\n      ...BUNDLED_ENTRY_RUNTIME_EXTERNAL_DEPS,\n      ...BETTER_AUTH_CLI_EXTERNAL_PATTERNS,\n      ...CLI_BUILD_TOOL_EXTERNAL_PATTERNS,\n    ],\n    onlyBundle: false,\n  };\n}\n","import { bundledEntryDepsConfig, libraryBuildDepsConfig, userAppBuildDepsConfig } from \"./deps.js\";\n\nexport {\n  isNativeRuntimeDep,\n  NATIVE_RUNTIME_DEPS,\n  bundledEntryDepsConfig,\n  cliBundledEntryDepsConfig,\n  libraryBuildDepsConfig,\n  userAppBuildDepsConfig,\n} from \"./deps.js\";\n\nexport const baseTsdownConfig = {\n  format: [\"esm\", \"cjs\"],\n  dts: true,\n  clean: true,\n  sourcemap: true,\n  target: \"node20\",\n  deps: libraryBuildDepsConfig(),\n};\n\n/** tsdown config for published bundles (cli, keystroke, platform). */\nexport const bundledEntryTsdownConfig = {\n  format: [\"esm\", \"cjs\"],\n  dts: true,\n  clean: true,\n  sourcemap: true,\n  target: \"node20\",\n  deps: bundledEntryDepsConfig(),\n};\n","import { t as resolveModuleDirs } from \"./resolve-module-dirs-BPHQhRGy.mjs\";\nimport { existsSync, mkdirSync, readdirSync, statSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { entryIdFromFile } from \"@keystrokehq/server/discovery\";\nimport { packAssetDirs } from \"@keystrokehq/sandbox/files\";\nimport { baseTsdownConfig, userAppBuildDepsConfig } from \"@keystrokehq/tsdown-config\";\nimport { build, mergeConfig } from \"tsdown\";\n//#region src/resolve-runtime-artifact.ts\nfunction packageRoot(nodeModules, scope, name) {\n\tconst direct = scope ? join(nodeModules, scope, name) : join(nodeModules, name);\n\tif (existsSync(join(direct, \"package.json\"))) return direct;\n\tconst pnpmDir = join(nodeModules, \".pnpm\");\n\tif (!existsSync(pnpmDir)) return null;\n\tfor (const entry of readdirSync(pnpmDir)) {\n\t\tconst candidate = scope ? join(pnpmDir, entry, \"node_modules\", scope, name) : join(pnpmDir, entry, \"node_modules\", name);\n\t\tif (existsSync(join(candidate, \"package.json\"))) return candidate;\n\t}\n\treturn null;\n}\n/** Resolve a file shipped with `@keystrokehq/build` inside the CLI runtime. */\nfunction resolveRuntimeBuildArtifact(runtimeNodeModules, relativePath) {\n\tconst pkgRoot = packageRoot(runtimeNodeModules, \"@keystrokehq\", \"build\");\n\tif (!pkgRoot) throw new Error(\"Keystroke runtime is missing @keystrokehq/build\");\n\tconst artifact = join(pkgRoot, relativePath);\n\tif (!existsSync(artifact)) throw new Error(`Keystroke runtime artifact not found: ${relativePath}`);\n\treturn artifact;\n}\n//#endregion\n//#region src/vitest-plugin.ts\nconst ASSETS_MODULE$1 = \"@keystrokehq/assets\";\nconst virtualPrefix = `\\0${ASSETS_MODULE$1}:`;\n/** Vitest plugin resolving `@keystrokehq/assets` from disk. */\nfunction agentAssetsVitestPlugin(appRoot = process.cwd()) {\n\tlet manifest = null;\n\treturn {\n\t\tname: \"keystroke-assets\",\n\t\tresolveId(source) {\n\t\t\tif (source !== ASSETS_MODULE$1) return null;\n\t\t\treturn `${virtualPrefix}manifest`;\n\t\t},\n\t\tload(id) {\n\t\t\tif (id !== `${virtualPrefix}manifest`) return null;\n\t\t\tmanifest ??= packAssetDirs(appRoot);\n\t\t\treturn `export default ${JSON.stringify(manifest)};`;\n\t\t}\n\t};\n}\nfunction findAppRootFromConfig(configFile) {\n\tif (!configFile) return process.cwd();\n\treturn dirname(configFile);\n}\nfunction agentAssetsVitestPluginFromConfig(configFile) {\n\treturn agentAssetsVitestPlugin(findAppRootFromConfig(configFile));\n}\n//#endregion\n//#region src/index.ts\nconst ASSETS_MODULE = \"@keystrokehq/assets\";\nconst VIRTUAL_PREFIX = `\\0${ASSETS_MODULE}:`;\nfunction walkTypeScriptSources(dir) {\n\tif (!existsSync(dir)) return [];\n\tconst files = [];\n\tfor (const name of readdirSync(dir)) {\n\t\tconst path = join(dir, name);\n\t\tif (statSync(path).isDirectory()) files.push(...walkTypeScriptSources(path));\n\t\telse if (/\\.(ts|mts)$/.test(name) && !/\\.(int\\.)?test\\.(ts|mts)$/.test(name)) files.push(path);\n\t}\n\treturn files;\n}\nfunction discoveredEntries(dir, nestedEntry, prefix) {\n\tconst entries = {};\n\tfor (const filePath of walkTypeScriptSources(dir)) {\n\t\tconst id = entryIdFromFile(dir, filePath, { nestedEntry });\n\t\tif (!id) continue;\n\t\tentries[`${prefix}/${id}`] = filePath;\n\t}\n\treturn entries;\n}\nfunction renderAssetModule(manifest) {\n\treturn `export default ${JSON.stringify(manifest)};\\n`;\n}\n/** Rolldown plugin: pack src/skills + src/files and expose `@keystrokehq/assets`. */\nfunction agentAssetsPlugin(options) {\n\tconst srcDir = options.srcDir ?? \"src\";\n\tlet manifest = null;\n\treturn {\n\t\tname: \"keystroke-assets\",\n\t\tbuildStart() {\n\t\t\tmanifest = packAssetDirs(options.root, srcDir);\n\t\t},\n\t\tresolveId(source) {\n\t\t\tif (source !== ASSETS_MODULE) return null;\n\t\t\treturn `${VIRTUAL_PREFIX}manifest`;\n\t\t},\n\t\tload(id) {\n\t\t\tif (id !== `${VIRTUAL_PREFIX}manifest` || !manifest) return null;\n\t\t\treturn renderAssetModule(manifest);\n\t\t},\n\t\tbuildEnd() {\n\t\t\tif (!manifest) return;\n\t\t\tconst outDir = join(options.root, options.outDir ?? \"dist\", \".keystroke\");\n\t\t\tmkdirSync(outDir, { recursive: true });\n\t\t\twriteFileSync(join(outDir, \"assets.mjs\"), renderAssetModule(manifest));\n\t\t}\n\t};\n}\n/** Full tsdown config for user keystroke apps (config + discovered modules only). */\nfunction createAppBuildConfig(options = {}) {\n\tconst root = options.root ?? process.cwd();\n\tconst srcDir = options.srcDir ?? \"src\";\n\tconst outDir = options.outDir ?? \"dist\";\n\tconst srcRoot = join(root, srcDir);\n\tconst configEntry = existsSync(join(root, \"keystroke.config.ts\")) ? join(root, \"keystroke.config.ts\") : void 0;\n\tconst entries = {\n\t\t...configEntry ? { config: configEntry } : {},\n\t\t...discoveredEntries(join(srcRoot, \"agents\"), \"agent\", \"agents\"),\n\t\t...discoveredEntries(join(srcRoot, \"workflows\"), \"workflow\", \"workflows\"),\n\t\t...discoveredEntries(join(srcRoot, \"triggers\"), \"trigger\", \"triggers\")\n\t};\n\tif (Object.keys(entries).length === 0) throw new Error(\"Nothing to build — add keystroke.config.ts or modules under src/\");\n\treturn mergeConfig(baseTsdownConfig, {\n\t\tentry: entries,\n\t\tformat: [\"esm\"],\n\t\toutDir: join(root, outDir),\n\t\tclean: options.clean ?? true,\n\t\tdts: false,\n\t\tloader: { \".md\": \"text\" },\n\t\tdeps: userAppBuildDepsConfig(),\n\t\tplugins: [agentAssetsPlugin({\n\t\t\troot,\n\t\t\tsrcDir,\n\t\t\toutDir\n\t\t})]\n\t});\n}\n/** Build user agents, workflows, triggers, and config to `dist/`. */\nasync function buildApp(options = {}) {\n\tconst root = options.root ?? process.cwd();\n\tconst previous = process.cwd();\n\ttry {\n\t\tprocess.chdir(root);\n\t\tawait build(createAppBuildConfig({\n\t\t\t...options,\n\t\t\troot\n\t\t}));\n\t} finally {\n\t\tprocess.chdir(previous);\n\t}\n}\n/**\n* Watch `src/` and rebuild `dist/` on change.\n*\n* NOT true hot reload — each change runs a full tsdown rebuild. Callers should\n* restart the API server in `onRebuild` so discovery picks up new/changed modules.\n*/\nasync function watchApp(options = {}) {\n\tconst { runWatchApp } = await import(\"./watch-app-DTIeKrbl.mjs\");\n\tawait runWatchApp(buildApp, options);\n}\n//#endregion\nexport { agentAssetsVitestPlugin, agentAssetsVitestPluginFromConfig, buildApp, createAppBuildConfig, resolveModuleDirs, resolveRuntimeBuildArtifact, watchApp };\n\n//# sourceMappingURL=index.mjs.map"],"mappings":";;;;;;;;;AAEA,MAAM,aAAa;AACnB,MAAM,mBAAmB;AACzB,SAAS,gBAAgB,SAAS,UAAU,SAAS;CACpD,IAAI,iBAAiB,KAAK,QAAQ,GAAG,OAAO;CAC5C,MAAM,WAAW,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK;CAC/C,IAAI,4BAA4B,KAAK,QAAQ,GAAG,OAAO;CACvD,MAAM,WAAW,SAAS,SAAS,QAAQ,EAAE,QAAQ,YAAY,EAAE,EAAE,MAAM,GAAG,EAAE,QAAQ,YAAY,QAAQ,SAAS,CAAC;CACtH,IAAI,SAAS,WAAW,GAAG,OAAO,SAAS,MAAM;CACjD,MAAM,OAAO,SAAS,GAAG,EAAE;CAC3B,MAAM,aAAa,IAAI,IAAI,CAAC,QAAQ,WAAW,CAAC;CAChD,IAAI,QAAQ,eAAe,OAAO,WAAW,IAAI,OAAO;CACxD,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,GAAG,OAAO;CAC3C,MAAM,KAAK,SAAS,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;CACzC,OAAO,GAAG,SAAS,IAAI,KAAK;AAC7B;;;ACDA,MAAM,2BAA2BA,OAAS;CACzC,MAAMC,OAAS;CACf,MAAMA,OAAS;AAChB,CAAC;;AAED,MAAM,oBAAoBD,OAAS;CAClC,MAAMC,OAAS;;CAEf,MAAMA,OAAS,EAAE,SAAS;;CAE1B,KAAKC,MAAQ,wBAAwB,EAAE,SAAS;AACjD,CAAC;AAC+BF,OAAS;CACxC,KAAKC,OAAS,EAAE,SAAS;CACzB,OAAOC,MAAQ,iBAAiB,EAAE,SAAS;AAC5C,CAAC;AAwDD,MAAM,cAAc,IAAI,IAAI,CAAC,QAAQ,cAAc,CAAC;;AAEpD,SAAS,gBAAgB,UAAU;CAClC,MAAM,OAAO,SAAS,QAAQ;CAC9B,IAAI,KAAK,OAAO,GAAG,OAAO,CAAC;EAC1B,MAAM,SAAS,QAAQ;EACvB,MAAM,aAAa,UAAU,MAAM;CACpC,CAAC;CACD,IAAI,CAAC,KAAK,YAAY,GAAG,MAAM,IAAI,MAAM,mCAAmC,UAAU;CACtF,MAAM,QAAQ,CAAC;CACf,QAAQ,UAAU,UAAU,KAAK;CACjC,OAAO;AACR;AACA,SAAS,QAAQ,UAAU,aAAa,OAAO;CAC9C,KAAK,MAAM,QAAQ,YAAY,WAAW,GAAG;EAC5C,IAAI,YAAY,IAAI,IAAI,GAAG;EAC3B,MAAM,YAAY,KAAK,aAAa,IAAI;EACxC,MAAM,OAAO,SAAS,SAAS;EAC/B,IAAI,KAAK,YAAY,GAAG;GACvB,QAAQ,UAAU,WAAW,KAAK;GAClC;EACD;EACA,IAAI,CAAC,KAAK,OAAO,GAAG;EACpB,MAAM,KAAK;GACV,MAAM,SAAS,UAAU,SAAS;GAClC,MAAM,aAAa,WAAW,MAAM;EACrC,CAAC;CACF;AACD;AAGA,MAAM,YAAY,IAAI,IAAI,CAAC,QAAQ,cAAc,CAAC;;AAElD,SAAS,cAAc,SAAS,SAAS,OAAO;CAC/C,OAAO;EACN,QAAQ,cAAc,KAAK,SAAS,QAAQ,QAAQ,CAAC;EACrD,OAAO,cAAc,KAAK,SAAS,QAAQ,OAAO,CAAC;CACpD;AACD;AACA,SAAS,cAAc,UAAU;CAChC,IAAI,CAAC,SAAS,UAAU,EAAE,gBAAgB,MAAM,CAAC,GAAG,YAAY,GAAG,OAAO,CAAC;CAC3E,MAAM,WAAW,CAAC;CAClB,KAAK,MAAM,QAAQ,YAAY,QAAQ,GAAG;EACzC,IAAI,UAAU,IAAI,IAAI,GAAG;EACzB,MAAM,YAAY,KAAK,UAAU,IAAI;EACrC,IAAI,CAAC,SAAS,SAAS,EAAE,YAAY,GAAG;EACxC,SAAS,QAAQ,gBAAgB,SAAS;CAC3C;CACA,OAAO;AACR;;;;ACpIA,MAAa,sBAAsB;CAAC;CAAM;CAAkB;AAAiB;;AAG7E,MAAa,wBAAwB;CAAC;CAAe;CAAmB;AAAgB;;AAiBxF,MAAa,8BAA8B,CACzC,GAAG;CAdH,GAAG;CACH;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAKG,GACH,GAAG,qBACL;;AAGA,MAAa,qCAAqC,CAChD,yBACA,wBACF;AASA,SAAgB,mBAAmB,IAAI;CACrC,OAAO,oBAAoB,MAAM,QAAQ,OAAO,OAAO,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC;AACjF;AAEA,SAAS,YAAY,IAAI;CACvB,IAAI,GAAG,WAAW,GAAG,GAAG;EACtB,MAAM,CAAC,OAAO,QAAQ,GAAG,MAAM,GAAG;EAClC,OAAO,OAAO,GAAG,MAAM,GAAG,SAAS;CACrC;CAEA,OAAO,GAAG,MAAM,GAAG,EAAE,MAAM;AAC7B;AAEA,SAAS,kBAAkB,IAAI;CAC7B,MAAM,OAAO,YAAY,EAAE;CAC3B,IAAI,mBAAmB,IAAI,GACzB,OAAO;CAGT,IAAI,KAAK,WAAW,eAAe,GACjC,OAAO;CAGT,IAAI,SAAS,iBAAiB,KAAK,WAAW,eAAe,GAC3D,OAAO;CAGT,OAAO;AACT;;AAGA,SAAgB,yBAAyB;CACvC,OAAO;EACL,eAAe,QAAQ;EACvB,aAAa;GAAC,GAAG;GAAqB;GAAmB,GAAG;EAAqB;EACjF,YAAY;CACd;AACF;;AAGA,SAAgB,yBAAyB;CACvC,OAAO;EACL,eAAe,IAAI,cAAc;GAC/B,IAAI,GAAG,WAAW,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,UAAU,EAAE,GAC1D,OAAO;GAGT,OAAO,kBAAkB,EAAE,IAAI,OAAO;EACxC;EACA,aAAa;GAAC,GAAG;GAAqB;GAAmB,GAAG;EAAqB;EACjF,YAAY;CACd;AACF;;;;;;AAOA,SAAgB,yBAAyB;CACvC,OAAO;EACL,cAAc,CAAC,iBAAiB;EAChC,aAAa,CAAC,GAAG,2BAA2B;EAC5C,YAAY;CACd;AACF;AAG+C,CAC7C,GAAG,kCAEL;;;ACrGA,MAAa,mBAAmB;CAC9B,QAAQ,CAAC,OAAO,KAAK;CACrB,KAAK;CACL,OAAO;CACP,WAAW;CACX,QAAQ;CACR,MAAM,uBAAuB;AAC/B;AASQ,uBAAuB;;;ACnB/B,SAAS,YAAY,aAAa,OAAO,MAAM;CAC9C,MAAM,SAAS,QAAQ,KAAK,aAAa,OAAO,IAAI,IAAI,KAAK,aAAa,IAAI;CAC9E,IAAI,WAAW,KAAK,QAAQ,cAAc,CAAC,GAAG,OAAO;CACrD,MAAM,UAAU,KAAK,aAAa,OAAO;CACzC,IAAI,CAAC,WAAW,OAAO,GAAG,OAAO;CACjC,KAAK,MAAM,SAAS,YAAY,OAAO,GAAG;EACzC,MAAM,YAAY,QAAQ,KAAK,SAAS,OAAO,gBAAgB,OAAO,IAAI,IAAI,KAAK,SAAS,OAAO,gBAAgB,IAAI;EACvH,IAAI,WAAW,KAAK,WAAW,cAAc,CAAC,GAAG,OAAO;CACzD;CACA,OAAO;AACR;;AAEA,SAAS,4BAA4B,oBAAoB,cAAc;CACtE,MAAM,UAAU,YAAY,oBAAoB,gBAAgB,OAAO;CACvE,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,iDAAiD;CAC/E,MAAM,WAAW,KAAK,SAAS,YAAY;CAC3C,IAAI,CAAC,WAAW,QAAQ,GAAG,MAAM,IAAI,MAAM,yCAAyC,cAAc;CAClG,OAAO;AACR;AA8BA,MAAM,gBAAgB;AACtB,MAAM,iBAAiB,KAAK,cAAc;AAC1C,SAAS,sBAAsB,KAAK;CACnC,IAAI,CAAC,WAAW,GAAG,GAAG,OAAO,CAAC;CAC9B,MAAM,QAAQ,CAAC;CACf,KAAK,MAAM,QAAQ,YAAY,GAAG,GAAG;EACpC,MAAM,OAAO,KAAK,KAAK,IAAI;EAC3B,IAAI,SAAS,IAAI,EAAE,YAAY,GAAG,MAAM,KAAK,GAAG,sBAAsB,IAAI,CAAC;OACtE,IAAI,cAAc,KAAK,IAAI,KAAK,CAAC,4BAA4B,KAAK,IAAI,GAAG,MAAM,KAAK,IAAI;CAC9F;CACA,OAAO;AACR;AACA,SAAS,kBAAkB,KAAK,aAAa,QAAQ;CACpD,MAAM,UAAU,CAAC;CACjB,KAAK,MAAM,YAAY,sBAAsB,GAAG,GAAG;EAClD,MAAM,KAAK,gBAAgB,KAAK,UAAU,EAAE,YAAY,CAAC;EACzD,IAAI,CAAC,IAAI;EACT,QAAQ,GAAG,OAAO,GAAG,QAAQ;CAC9B;CACA,OAAO;AACR;AACA,SAAS,kBAAkB,UAAU;CACpC,OAAO,kBAAkB,KAAK,UAAU,QAAQ,EAAE;AACnD;;AAEA,SAAS,kBAAkB,SAAS;CACnC,MAAM,SAAS,QAAQ,UAAU;CACjC,IAAI,WAAW;CACf,OAAO;EACN,MAAM;EACN,aAAa;GACZ,WAAW,cAAc,QAAQ,MAAM,MAAM;EAC9C;EACA,UAAU,QAAQ;GACjB,IAAI,WAAW,eAAe,OAAO;GACrC,OAAO,GAAG,eAAe;EAC1B;EACA,KAAK,IAAI;GACR,IAAI,OAAO,GAAG,eAAe,aAAa,CAAC,UAAU,OAAO;GAC5D,OAAO,kBAAkB,QAAQ;EAClC;EACA,WAAW;GACV,IAAI,CAAC,UAAU;GACf,MAAM,SAAS,KAAK,QAAQ,MAAM,QAAQ,UAAU,QAAQ,YAAY;GACxE,UAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;GACrC,cAAc,KAAK,QAAQ,YAAY,GAAG,kBAAkB,QAAQ,CAAC;EACtE;CACD;AACD;;AAEA,SAAS,qBAAqB,UAAU,CAAC,GAAG;CAC3C,MAAM,OAAO,QAAQ,QAAQ,QAAQ,IAAI;CACzC,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,UAAU,KAAK,MAAM,MAAM;CACjC,MAAM,cAAc,WAAW,KAAK,MAAM,qBAAqB,CAAC,IAAI,KAAK,MAAM,qBAAqB,IAAI,KAAK;CAC7G,MAAM,UAAU;EACf,GAAG,cAAc,EAAE,QAAQ,YAAY,IAAI,CAAC;EAC5C,GAAG,kBAAkB,KAAK,SAAS,QAAQ,GAAG,SAAS,QAAQ;EAC/D,GAAG,kBAAkB,KAAK,SAAS,WAAW,GAAG,YAAY,WAAW;EACxE,GAAG,kBAAkB,KAAK,SAAS,UAAU,GAAG,WAAW,UAAU;CACtE;CACA,IAAI,OAAO,KAAK,OAAO,EAAE,WAAW,GAAG,MAAM,IAAI,MAAM,kEAAkE;CACzH,OAAO,YAAY,kBAAkB;EACpC,OAAO;EACP,QAAQ,CAAC,KAAK;EACd,QAAQ,KAAK,MAAM,MAAM;EACzB,OAAO,QAAQ,SAAS;EACxB,KAAK;EACL,QAAQ,EAAE,OAAO,OAAO;EACxB,MAAM,uBAAuB;EAC7B,SAAS,CAAC,kBAAkB;GAC3B;GACA;GACA;EACD,CAAC,CAAC;CACH,CAAC;AACF;;AAEA,eAAe,SAAS,UAAU,CAAC,GAAG;CACrC,MAAM,OAAO,QAAQ,QAAQ,QAAQ,IAAI;CACzC,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI;EACH,QAAQ,MAAM,IAAI;EAClB,MAAM,MAAM,qBAAqB;GAChC,GAAG;GACH;EACD,CAAC,CAAC;CACH,UAAU;EACT,QAAQ,MAAM,QAAQ;CACvB;AACD;;;;;;;AAOA,eAAe,SAAS,UAAU,CAAC,GAAG;CACrC,MAAM,EAAE,gBAAgB,MAAM,OAAO;CACrC,MAAM,YAAY,UAAU,OAAO;AACpC"}